Hearing of the Subcommittee on Cybersecurity and Infrastructure Protection of the House Homeland Security Committee - Opening Statement of Rep. Bennie Thompson, Hearing on Examining DHS' Efforts to Strengthen its Cybersecurity Workforce

Hearing

Recruiting and retaining a qualified cybersecurity workforce at the Department of
Homeland Security is a national security imperative.

Every day, we learn more about the efforts of our adversaries -- from Russia and Iran
to North Korea and China -- to use their cyber tools to attack our economy, our critical
infrastructure, and the pillars of our democracy, including our election systems.

In the wake of this evolving threat landscape, public and private-sector critical
infrastructure owners and operators look the Department of Homeland Security's
National Protection and Programs Directorate (NPPD) to share information on cyber
threats, to provide cybersecurity assessments, and to deploy incident response teams
following an incident, among other things.

Yet, when Assistant Secretary for Cybersecurity and Communications Jeanette
Manfra testified before this panel last October, she told me that 24 percent of the fully-
funded cybersecurity workforce billets at NPPD were unfilled.

In 2014, Congress gave DHS hiring authorities on par with the Department of Defense
to address cybersecurity staffing challenges. Although DHS clamored for these
authorities for several years prior to 2014, the Department does not plan to fully
implement them until April 2019 -- five years after Congress authorized expedited
hiring.

We cannot afford to waste that kind of time.

Last month, FBI Director Wray, CIA Director Pompeo, NSA Director Rogers, and
Director of National Intelligence Coats, DIA Director Ashley, and NGA Director Cardillo
all testified before the Senate Intelligence Committee and unanimously agreed that
Russia would continue its election meddling efforts into the 2018 midterm elections.

Last week, NSA Director Rogers again confirmed that the Russian government is
actively targeting U.S. election systems.

Secretary of State Tillerson also agrees that the Russians are targeting midterm
elections, yet has not spent any of the funds Congress appropriated to the agency to
address the ongoing threat to the integrity of our elections.

Congress granted the State Department $120 million to counter Russian election
meddling, including $60 million to coordinate anti-propaganda efforts with agencieslike the Department of Homeland Security.

That said, NPPD has an important role to play in this space and has, in many ways,
stepped up.

I am pleased that it has prioritized services for election administrators, and that all of
the 14 requested risk and vulnerability assessments will be concluded by next month.

But I understand that NPPD had to shift resources to complete the assessments, and I
am concerned that it will need more resources -- and more trained cybersecurity
professionals -- to meet the ongoing obligations of the critical infrastructure subsector
designation. As threats to the homeland continue to evolve, NPPD and its partners
throughout DHS, will need a strong, qualified cybersecurity workforce.

Congress has given DHS the authorities and structures it needs to develop that
workforce, and it is on DHS to implement them. Ultimately, as much as the increased
demand for a qualified cybersecurity workforce poses a challenge, it also creates
opportunities.

When DHS finally completes the process for coding its cybersecurity workforce, it will
be able to target recruiting at more diverse talent pools -- from community colleges to
veterans' groups. I will be interested in learning what efforts DHS is undertaking to
recruit untapped talent, as well as cultivate and retain its workforce.

Source