“AT BOOZ ALLEN, we’re shaping the future of cyber-security,” trumpets a recruiting message on the website of Booz Allen Hamilton, a consulting and technology firm. It is hard to argue with that blurb right now. Edward Snowden, the man who revealed he was responsible for leaks about surveillance of American citizens by the National Security Agency (NSA), was a contractor working for Booz Allen. That has turned a spotlight on the extensive involvement of private firms in helping America’s spooks to do their jobs. The affair could lead to changes in the way these relationships work.
As a result of the leaks, politicians are likely to debate the pros and cons of outsourcing sensitive work monitoring online communications and security threats to firms such as Booz Allen, which has close links to the intelligence establishment. Many of its more than 25,000 employees have some form of government security clearance and Mike McConnell, who heads its fast-growing cyber-security business, is a former Director of National Intelligence. The current director, James Clapper, is a former Booz Allen executive.
- Hiring digital 007s
- An ill wind
- Street plan
- Superman v Spider-Man
- I dreamed a stream
- Redeemers of a macho society
But while Booz Allen has hogged the headlines, much to the chagrin of its leaders, a broader trend has gone largely unremarked. A number of high-ranking cyber-security experts from places such as the FBI, the Department of Homeland Security (DHS) and the White House have left government in recent years and are now working in various capacities for specialist consulting firms or start-ups offering security technology and services. The table below lists some examples.
Anecdotal evidence suggests this exodus of talent is increasing. Peter Metzger, a headhunter at CTPartners in Washington, DC, whose work includes hiring cybersecurity officials for companies, says the number of such assignments has doubled in the past 12 months. A recent wave ofsenior departures from the DHS has attracted politicians’ attention. At a meeting in May of a House of Representatives subcommittee that focuses on cyber-security issues, Yvette Clarke, one of its members, expressed concern about “the continuing drain of senior cyber-security leadership” at the department, noting that it “has gotten particularly bad in the last six months.”
One of those who has left is Mark Weatherford, who quit last month as deputy under-secretary for cyber-security at the DHS to join the Chertoff Group, a consultancy. He has also joined the advisory boards of Coalfire, a firm that helps companies identify technology-related risks and deal with compliance issues, and Cylance, a cyber-security outfit.
Like Mr Weatherford, Sameer Bhalotra has found himself in demand. On leaving his job as senior cyber-security official at the White House last year, he was hired as chief operating officer of Impermium, a cyber-security start-up. On June 10th Mr Bhalotra also joined the advisory board of Damballa, which offers software to speed up companies’ responses to attacks on their networks. He says he expects to take on more advisory positions soon.
The role of firms such as Booz Allen in the intelligence arena and the flow of government cyber-tsars into tech companies are evidence of an emerging cyber-industrial complex in which the private and public sectors are intimately linked. Some will see this as a worrying development, noting that President Dwight Eisenhower used the term “military-industrial complex” in a speech in 1961 to give warning about the dangers of too cosy a relationship between government, military men and defence contractors.
There are risks inherent in the cyber-industrial complex too. Mr Snowden’s leak will raise questions about just how watertight firms such as Booz Allen can keep their operations. (The company declined to comment for this article.) There is also a theoretical risk that former officials might tap their chums in government to give their new employers an unfair advantage in bidding for federal contracts or to influence policy for commercial advantage.
But there are also reasons why the cyber-industrial complex should, on balance, be welcomed. For a start, many talented but quirky techies would refuse to work for government agencies, which are unlikely to be hoodie-friendly. Better to have them work as contractors than not to enlist their talents at all. Deep-pocketed firms may also be best placed to attract rare birds such as data scientists. Lattice Engines, a software company looking into hiring trends in the data field, reckons Booz Allen has over 300 vacancies for such people and may well be recruiting more of them than Google or Facebook.
Because of the danger that online security threats pose, companies need to co-operate closely with government spooks and crimebusters to counter them. Former cyber-officials can advise firms how best to do this. Moreover, if the government wants to continue to benefit from the savvy of its departing cyber-warriors, it can always hire their new firms.
Government types can also help cyber-security firms and consultancies, which are prime targets for hackers, to protect their own operations better. Dmitri Alperovitch, a founder of CrowdStrike, a cyber-security company that hired Shawn Henry after he retired from a senior position at the FBI, says that in addition to working with clients Mr Henry is also responsible for CrowdStrike’s own internal security.
That still leaves the issue of persuading enough talented cyber-warriors to remain in government. Ironically, Mr Metzger, the headhunter, thinks the NSA furore will mean even more work for him. Some boards have been slow to wake up to the gravity of cyber-risks, he says. But now that executives realise their own calls and e-mails are being monitored, they are more likely to take the threats seriously.
Powered by Facebook Comments