Hathaway opens up about her decision to leave White House, cyber coordinator future role

Melissa Hathaway once spent an hour briefing President Obama and answering questions about cybersecurity.

The former acting senior director for cybersecurity in the White House says the President not only gets the importance of hardening federal and commercial networks, but laid out priorities for the government to initially focus on.

"There were certain priorities he wanted us to kick off first, beginning with the dialogue with the American people," says Hathaway in an exclusive interview with FederalNewsRadio. "Second was how to operationalize public and private partnerships focusing on financial services and energy sectors. The President understood the severity of the situation and what he wanted to be done for the country."

She dismisses any comments that the administration doesn't understand why cybersecurity needs to be improved. And the lack of a permanent cyber coordinator is not a sign of a lack of priority.

But Hathaway says it's unclear when the White House will name someone to fill the position permanently.

"I helped put names on the list and establish evaluation criteria for the person," she says. "We had discussed a number of different people who should be considered. It is the President's decision, but a number of others are key people in the decision making process including [National Security Advisor] Gen. James Jones, [Director of the White House's National Economic Council] Lawrence Summers and [Assistant to the President for Homeland Security and Counterterrorism] John Brennan. The person needs to have a strong background in not just national security policy, but also economic security policy."

And that criteria was in part one reason why Hathaway believes she never was seriously considered for the position.

"I knew when the President gave his speech I wasn't going to be named," she says. "There were number of people were being considered including myself. There were number of people on a list to be considered and we all had different backgrounds and experiences coming into the evaluation criteria."

Hathaway says her decision to leave had less to do with her not getting the position and more to do with needing better work-life balance. Hathaway has said from the beginning of the cyberspace review until it was finished she worked six-to-seven days a week and 12-to-15 hours a day. At one point, she worked 70-plus days without a full day off.

"I never thought about spending more than two years and I spent two-and-a-half years in government," she says. "There were a number of factors that played into my decision to leave, most of which was my family. I have two young boys who are 8 and 9 and I missed a lot in their lives."

She also says her impact could be just as considerable from the outside.

"As I started to look at what was going to be required going forward, I thought I would be more effective from the private sector and being able to work on many of the recommendations we made in the cyberspace review but from a different vantage point," Hathaway says. "I actually spent a number of months after the cyberspace review helping get the work started on all the top 10 recommendations and I met with a number of senior decision makers in the White House on how we should continue the prioritization while we look for who is the right lead for carrying it forward."

Now that she has left government, Hathaway says she has opened her own consulting firm, will work with Harvard Kennedy School of Government and law school, and the Massachusetts Institute of Technology on assorted speaking, writing and research projects.

She also will provide consulting services to defense and telecommunications companies who want to work in the federal and international cybersecurity spaces.

As the future of the cyber coordinator position, Hathaway says she doesn't get too involved in the conversation about where the coordinator sits in the White House.

The 60-day report recommended the person having a seat on both the National Economic and National Security councils.

Hathaway says she continues to support that recommendation.

"In the National Economic Council that is where we are discussing smart grid, next generation FAA, health IT reform as well as broadband to last mile of local towns and all of those have a cybersecurity component," she says. "It is really important for the person to sit within both councils. Similar to the role a person has where the National Economic Council is his primary home and they have a voice in the National Security Council to bring economic view points to national security discussions."

She also says the person must elevated higher than a special assistant to the President where the position stood during the Bush administration.

"So long as the person is elevated and has the ability to influence decisions in both councils it may not matter if they are a assistant to the President or deputy assistant to the President," Hathaway adds.

And don't use the term cyber czar either. She hates both the word and the idea it connotates.

"You may have heard me say this before, but nothing good can come from a czar, the peasants hate them and nobles want to kill them," Hathaway jokes.

But she turns more serious and continues about the word czar is no good.

"The person needs to be a team player who can build consensus across so many different constituencies and that is not what comes to mind when you say czar," she adds.

Whoever eventually fills the cyber coordinator role, Hathaway offers little advice.

"I would advise them to read the 60-day cyberspace review and all annexes that go along with it," she says.

Hathaway, however, says there is plenty for agencies and the country to focus on around cybersecurity.

She says three specific areas are:

• Raise public awareness and communicate what's at risk and at stake for the country both economically and securitywise. "That national dialogue is just beginning and we need to do a much better job in communicating what's happening."

• Public and private partnerships. Hathaway says the private sector is the corner stone of cybersecurity. "We need to do everything we can from the private sector and the government to build our relationship and put processes in place to build security back into our core infrastructure."

• International participation and cooperation. She says there are more than 20 international venues determining standards for core infrastructures going forward, and rules of engagement and what's ethical or correct behavior in cyberspace.

More specifically, Hathaway says while agencies have made significant progress over the last three years around teaming and information sharing, there still are some big holes.

She says patch management and basic network hygiene still is lacking across most agencies.

"An area the government still needs to work on is how to extend processes beyond the people and have repeated processes and corporate knowledge that can carry over when you do have people leave key roles," she says. "That you really have a process that can carry forward as opposed to the people who carry issues forward."

She says when she left the White House, her office had made a list of the top 10 recommendations from the cyberspace review with timelines and deliverables.

Agencies have been raising the importance of cybersecurity across their organizations is one area where Hathaway sees progress. The expansion of cyber commands or units across the Defense Department, and the renewed focus at the Homeland Security Department also are examples of progress, she says.

In fact, DHS has regularly been asking DoD for help.

"The National Security Agency brings a lot to the table in its information assurance role they have for the Defense Department," she says. "Their technical expertise can be brought to bear for other parts of government but only upon request through a technical assistance letter. And that's been happening fairly regularly with their partnership with DHS lately."

And these examples are among the reasons why Hathaway holds plenty of hope for future improvements across the public and private sectors around cybersecurity.

-----
On the Web:

FederalNewsRadio - Justice's Painter replaces Hathaway as acting cyber coordinator

FederalNewsRadio - Langevin 'concerned and disappointed': still no cybersecurity czar

FederalNewsRadio - Hathaway resigns as White House cyber lead

FederalNewsRadio - DNI's Hathaway to lead White House cyber office

FederalNewsRadio - White House cyber review is just the beginning

(Copyright 2009 by FederalNewsRadio.com. All Rights Reserved.)