Johnson: Cyber reorg should be priority for next Congress

The reorganization of the Department of Homeland Security's cyber operations division should be at the top of the to-do list of the next Congress, said agency Secretary Jeh Johnson.

Plans to rename and reorganize the National Protection and Programs Division to integrate it with critical infrastructure protection are awaiting action on Capitol Hill.

"We need to get Congress to work on the reorganization of the NPPD," into a leaner and meaner cybersecurity agency, said Johnson in a Sept. 8 panel discussion on homeland security hosted by the Atlantic. "It should be the number one priority," he said in response to a question about what advice he would give his successor.

A bill authorizing the transformation of NPPD into the Cybersecurity and Infrastructure Protection Agency is still stalled in the House. The reorganization would bind cyber and physical security capabilities more closely, to better reflect the links between cyber and physical threats. It would also make NPPD another operating agency within DHS.

The reorganization, Johnson said, is a vital part of the DHS' Unity of Effort initiative begun in 2014 to address resource allocation and organizational management.

NPPD Undersecretary Suzanne Spaulding said the proposed reorganization is also a key part of DHS' risk management strategy, which identifies and prioritizes security efforts. Standing up the reorganized NPPD as the Cybersecurity and Infrastructure Protection Agency would add the first new operational component to DHS since its inception and recognize fundamental changes in cybersecurity.

Johnson and former DHS Secretary Tom Ridge, who spoke on the same panel, said the sprawling oversight of myriad congressional committees was a big factor in how DHS currently operates. Both men said the next DHS secretary should understand why congressional oversight is important in guiding the agency, and prepare for the many committees and subcommittees currently committed to the process.

Johnson said DHS takes pains to reply to every congressional inquiry sent its way, and even managed to reduce the time it took to respond to within 14 days. "It takes time to respond," he added.

An answer to that problem may be coming from Congress.

House Homeland Security Chairman Michael McCaul (R-Texas) said the multiple overlapping congressional committees and subcommittees overseeing DHS "are crippling it."

McCaul wants to see one committee in the Senate and one committee in the House to have oversight of DHS. Inaction on reforming congressional oversight of the agency, he said, "will cause problems."

McCaul also plans to offer recommendations on revising the overall DHS structure for the next administration. The growing efficiencies that cloud and other IT advances can offer have changed the dynamics governing how the agency’s components might be integrated, he said. He declined to give more specifics on the report, saying it was in development.

Elections at risk?

Addressing another cybersecurity front -- the possibility of nation-state-backed hacks on U.S. states election systems -- Johnson said a hack on those systems would have to get past a significant obstacle.

"It would be difficult through a cyberattack to alter ballot counts because it's so decentralized," he said, noting that the U.S. election system is mostly owned and operated by states.

Along the same lines, he said DHS is not trying to take over state election systems.  The department has been offering cybersecurity help to states thought its National Cybersecurity and Communications Integration Center and other cybersecurity resources.

DHS also is considering making the election system part of the set of critical U.S. infrastructure that has federal protections.

However, that move, he said, "does not mean a federal take-over," Johnson said.