Making a CyberSec Bill a Campaign Issue

Sen. Mary Landrieu faces a tough re-election campaign in the red state of Louisiana, so the three-term Democrat is turning her position on a bill to strengthen Department of Homeland Security's cybersecurity workforce into campaign fodder to highlight her anti-Washington credentials with voters.

See Also: The Cybersecurity Swiss Army Knife for Info Guardians: ISO/IEC 27001

Landrieu was the only senator not to vote for the DHS Cybersecurity Workforce and Retention Act of 2014 when it passed the Senate Homeland Security and Governmental Affairs Committee by a voice vote on May 21; she voted present (see Row Deepens Over Bulk Collection Bill).

The bill grants the DHS secretary the authority to establish specific cybersecurity positions and provide competitive salaries and benefits to fill those jobs. "Basically throwing another $30 million to raise salaries inside the Washington beltway is not necessarily the answer," she said.

"Because so many jobs are clustered in the beltway, we basically have an arms race going on between federal agencies to hire limited pool of skilled workers," Landrieu said. "The agencies bid against each other and just raise the cost to the taxpayer."

Landrieu's objection to the bill won't scuttle it. But it's another example of a potential roadblock that has prevented bipartisan cybersecurity legislation from becoming law over the past half-decade. Another, more potent obstacle to getting the bill enacted is the demand by the committee's ranking member, Tom Coburn, R-Okla., that Congress identify spending cuts elsewhere in the federal government to fund this program. And, at the moment, there's no House version of this bill.

Evaluating Costs

But let's not be too dismissive of Landrieu's anti-Washington rhetoric even if it's not apropos in this situation.

One point Landrieu makes is that it would be cheaper to identify and hire new cybersecurity experts outside of Washington. In making her argument, Landrieu ticked off living costs in cities outside D.C., including in states of other committee members. In her home state, she noted that housing and grocery costs in Shreveport are 64 percent and 15 percent less, respectively, than in Washington.

The maximum salary in the government's senior executive service is $181,500, and Landrieu suggested the government could get a bigger bang for its buck if it recruited cybersecurity experts from elsewhere in the country. According to the CNN/Money cost-of-living calculator, the tool Landrieu used to compare utility and housing costs, an $180,000 salary in Washington equals $118,000 in Shreveport.

Landrieu, with an eye on the Louisiana electorate, touted the potential for creating a cybersecurity center along the Interstate 20 corridor that runs through Shreveport and nearby Brossier, where last week she hosted Homeland Security Secretary Jeh Johnson in her push to develop the cybersecurity workforce in her home state.

'Regular Universities'

During the committee debate, Landrieu characterized local Louisiana schools as just "regular universities, not anything fancy-dancy, like, you know, around here [Washington]. But they're turning out some great kids, some great opportunities."

Touting local schools as "regular universities" is debatable as effective campaign oratory, but Landrieu makes a good point: As more colleges and universities expand their cybersecurity degree programs, more IT security experts will be found in the heartland.

That's a lesson IT security managers in all sectors, not just the federal government, should heed as they seek qualified experts to join their staffs.

Still, the logic of Landrieu's argument falls short when one examines the reality of DHS cybersecurity staffing needs. As a sympathetic Coburn pointed out, DHS needs to staff installations based in and around Washington. "You aren't going to be able move NNCIC," Coburn said, referring to DHS's National Cybersecurity and Communications Integration Center, the Washington-based around-the-clock operations center that monitors and assists cyber exploits and threats.

"I agree with you in principle," Coburn told Landrieu during the debate. "But the problem is we need to fix cyber now; we need these people now."

That's why Landrieu said she feels torn about the legislation. "We need to think about building the cyber workforce, not just building it inside the blast zone, which is right here in Washington, D.C.," said Landrieu, who then listed local colleges that are graduating students with IT security know-how who might need to relocate to find work with the government.

"That's what worries me," she said. "These kids that would like to stay home [but] have to come to Washington, D.C., and we have to pay twice as much for the same person that we can get if they stayed at home because we're concentrating so many of our assets here. It's not right for the taxpayer. ... We're just exasperating the situation."

Perhaps Landrieu's right, but for now the need is in Washington, and the question is: Will Congress eventually do something about it?