New US cyber official wants ‘brutal honesty’ on industry collaboration efforts

The Cybersecurity and Infrastructure Security Agency’s newest official has a message for the private sector: tell us where we need to improve.

Jeff Greene, the newly appointed executive assistant director for the agency’s cybersecurity division, told an audience of private sector participants at a Wednesday U.S. Chamber of Commerce event that CISA is conducting “open house” discussions about where the U.S. government and industry partners can improve their abilities to collaborate and share information on cyber threats.

The remarks come in the wake of reports from earlier this year that said a slew of private sector players have been pulling back from the Joint Cyber Defense Collaborative — stood up by CISA in 2021 to encourage cyber firms to team up with the government to detect and deter hacking threats — due to various management mishaps, including cases where CISA allegedly did not staff enough technical analysts for the program.

“What we’re working on in JCDC and where I think we need to improve with it is, what is the steady state relationship? How does it differ between different partners?” said Greene. He declined to expand on specific discussions due to their sensitivity.

Broadly speaking, the conversations amount to an outline of “tell us what we’re doing well, tell us where we need to improve and help us get there,” he said. “And give us the grace to have a little time to get there because we’re juggling a lot of balls.”

The public-private partnerships, moreover, have been highly successful, he said, citing private conversations with industry friends that applauded JCDC.

He also pointed to a recent classified briefing he requested on Volt Typhoon, an advanced Chinese hacking collective that’s been found burrowing into U.S. critical infrastructure and has drawn strong public attention from the government and private sector.

“Why are we in a SCIF?” he asked himself — referring to sensitive compartmented information facilities used to disseminate classified data — when he realized that most of the information provided to him had already been distributed in the open. “The reality is there is so little information that we are not sharing on [Volt Typhoon] and other issues,” he told the audience.

CISA has referred to public-private partnerships as the “lifeblood” of its mission because it argues that industry operators often have visibility into hacking threats that are not immediately discernible to the federal government. 

The 2015 Cybersecurity Information Sharing Act enabled many of these collaboration efforts, though recent oversight reports have signaled that cyber threat sharing still needs improvements. Those include obstacles in classified arenas where private companies may be barred from accessing critical information that their cyber warriors can use to stop enemy hackers.

“Brutal honesty and feedback,” Greene said when asked what the private sector can do to help CISA. “Those of you who know me — I don’t mind being asked why. I don’t mind being told what we’re not doing well.”