White House Asserts Micromanagement Critique Was About a Previous Administration
National Cyber Director Chris Inglis speaks at a hearing with the House Committee on Oversight and Reform in the Rayburn House Office Building on November 16, 2021 in Washington, DC. Anna Moneymaker/Getty Images
By
Mariam Baksh
Debate is heating up over the role of sector-risk management agencies in shoring up security of the nation’s critical infrastructure.
National Cyber Director Chris Inglis made comments Thursday asserting overinvolvement by the White House in determining the actions of agencies with the responsibility to oversee certain sectors of critical infrastructure. But those statements were in reference to a previous administration, a White House official told Nextgov.
Speaking on the role of sector risk management agencies during a meeting of the Cybersecurity and Infrastructure Security Agency’s cybersecurity advisory committee, Inglis said, “Candidly, I think that what we've seen in the past, is the White House, not knowing that that is in fact the responsibility of CISA—and that the [Office of the National Cyber Director] should stand in and assist with that execution—the White House has stood in and micromanaged that, I think in a way that is well intentioned but not helpful.”
In addition to the Department of Homeland Security, sector risk management agencies include the departments of Treasury, Energy and others which were designated—via a 2013 presidential directive—to address risks to critical infrastructure. CISA, which is housed within DHS and is a non-regulatory agency, has control over 10 of 16 critical infrastructure sectors identified in the directive. And major industry representatives have recently taken issue—in the context of a new incident reporting law—with the regulatory approach being implemented at other agencies, such as the Securities and Exchange Commission, which has authority over the financial sector.
For other sectors, such as the pipeline industry, the current White House has supported a cybersecurity directive—enforceable by fines—issued by the Transportation Security Administration, and said other mandates may be necessary.
Inglis said the Office of the National Cyber Director is partnering with the Cybersecurity and Infrastructure Security Agency to study the appropriate role for the sector risk management agencies and will make recommendations for how their work can all be improved comprehensively.
“We can't do this episodically. We need to do this continuously and delegate that as to the appropriate party,” he said. “[CISA Director] Jen [Easterly] is the quarterback, I'm the coach, we're going to take that on.”
The study comes as CISA considers adding partners from other sectors to its Joint Cyber Defense Collaborative. JCDC is a project the agency launched in August with major information and communications technology firms like Amazon Web Services and AT&T, as well as cybersecurity companies like Crowdstrike and Palo Alto Networks. The idea was to create a space where the companies could safely exchange and act on information regarding potential cybersecurity threats and help address them throughout the larger ecosystem.
During the meeting Thursday, Tom Fanning, the CEO of Southern Company and chair of the committee, raised the issue in the context of a regulatory climate that he said “breeds [a] defensive mentality and kind of … compliance, check-the-box.”
“We have to deal with the era now in terms of laws and regulations. But by the same token, away from the here and now is the what may be,” Fanning said. “There may be a lot of structural changes as we reimagine national security and this collaboration with the private sector and government that will make things a lot better. And so we're trying to keep track on our virtual whiteboard as to what we could do in terms of new policies or law or regulation.”
Inglis’ office was not established until January, 2021, but reached for comment, a White House official said the director’s statement about the White House micromanaging the work of sector risk management agencies—which mentions the ONCD—was in reference to a previous administration.
“To suggest that the director was referring to the Biden-Harris Administration would be completely inaccurate and a misrepresentation of his words,” the official told Nextgov. “As Director Inglis noted, ‘in the past,’ there have been concerns about clarity on how roles and responsibilities are divided, something the creation of the Office of the National Cyber Director was intended to address.”