Getting security clearance to enter the Executive Office Building, a huge old building just west of the White House's West Wing, turned out to be a major ordeal. My bosses--ComputerUser CEO and General Counsel Vance Opperman and President and CFO Chuck Thell--had little trouble because they've both made numerous visits to several offices in Washington. But this was my first, which meant the security officers had to run my vital info against some database of suspected criminals. After I finally passed the test, we ascended to the third floor, which houses the Office of Management and Budget (OMB). There we found Mark Forman's office, a long, narrow foyer filled with assistants and a Spartan, large-windowed office behind the foyer.

Forman is associate director of information and e-government for OMB, which audits and approves the budget for all federal government IT and e-government projects. Because he is the gatekeeper for IT spending, he is, in effect, the CIO of the federal government.

Forman was able to squeeze our meeting in between a meeting with the CIO council and congressional testimony. Without getting into too many specifics, we talked about the enormous job of steadily improving the federal government's information systems. In a follow-up call I talked at length with him about the specifics of improving the security and privacy of government information systems and e-government initiatives.

One of the challenges you have acknowledged in public testimony before Congress is ensuring that every federal IT employee is adequately trained on IT security policies, procedures, and best practices. Could you describe these efforts in more detail?

Ensuring the security of the government's IT systems is the responsibility of all government employees. The problem with tightened security (and this is seen in the private sector as well) is that the stronger the IT security, the harder it is to use. If you require employees to regularly change their passwords, you will find Post-It notes stuck to the sides of their monitors with their passwords written on them. So you need to develop policies and procedures that all employees can follow to protect the systems they use.

Certain agencies, like the Department of Agriculture, regularly hold training programs for the workforce on good information practices. We have developed the Golearn.com Web site, which offers on-demand online training to all federal employees. Some of it's meant for more common jobs and some is more technical. There really are two different types of training; one for all government office workers and one for those with IT security responsibilities.

How much work is involved in putting in place a whole set of practices and policies to secure government information systems?

Every agency has to do a review of their systems as part of the budgeting process. Budgets are approved or not approved based on evaluations, assessments of risk, and identifying security gaps.

In order to evaluate systems, agencies have to establish a baseline of data. We made this a requirement for the first time on Sept. 10, 2001. A year later we had the baselines, and had about 10 months to implement the systems and performance measures. This involved clearly articulating progress or gaps and quantifying systems being secured properly.

Long-term, the process is iterative, so we went through another round of it in 2002. But based on the first round, we established milestones for 2002. And based on those milestones, agencies had found a lot more insecure systems and new vulnerabilities. This showed us that the system is working.

We knew that the process would pick up momentum, and this is reflected in our budgets. We spent $2.7 billion on security in 2002 and we budgeted for $4.2 billion in this fiscal year. Next year, we will ask for $4.7 billion. And the raw numbers don't indicate the full nature of our commitment. Spending on security has consistently gone up as a percentage of the overall budget.

Quarterly, agencies have to work with us to track the progress of these milestones. These reports have to be evaluated carefully. Some agencies have reported 100-percent progress, but if you have 100 percent progress when you start with 30 percent effectiveness, you still only have 60 percent effectiveness, which is not good enough. There's clearly a long way to go for a lot of agencies.

Also, the amount an agency spends on security does not necessarily correlate with the how secure an agency is. Those that do a good job may be a lot further along in the process and consequently don't need as many funds; those that don't appropriate for security properly might ask for more funds than they need because of architectural issues with their systems or other inefficiencies. We have to account for all these variables when we evaluate their budgets.

In the short term, threats materialize. We set up a set of systems that identify threats, generate a report and send the report to agency CIOs and senior security systems architects. Initially, our target was for every CIO to get the report within 24 hours of the threat. We've been able to get that down to 90 minutes or less.

Are there any plans to develop channel partner relationships with private IT security training providers? If so, what can you share about these plans with our readers?

Absolutely. We don't have any internal programs for training in civilian agencies. All our training is provided by the private sector. Golearn.com is bought in bulk from the private sector.

You said recently that the vast majority of IT services are conducted by private contractors. President Bush has stated his preference that future government initiatives favor private contractors. How do you make sure that these folks follow the appropriate security protocols when they develop solutions for the federal government?

It starts with good security management, and for us that starts with the business case. The OMB has to see and approve the business case for any IT investment. It's similar to what private-sector companies do when they review proposed budgets that include contractors.

But in our case, return on investment (ROI) is not always cash. ROI might be that the system saves lives, or leads to better homeland security. When we review these budgets, we ask questions like: How are you providing adequate security and privacy in your e-government initiatives? Is this investment worth it and at what cost? We now add security and privacy into the cost of the project, which we didn't always do before. We bring it back to the beginning of the process. We pull it back to the reference model or technology architecture. We make sure the architecture is related and tied into the enterprise architecture. We make sure the plan matches existing specifications; for example, if the plan is to implement a WLAN, do the security specs match those of the CIO of that department? Has that been done at the deployment level and for the lifecycle of the project?

Our yearly audit will pick up the security plans and measure them against milestones. If security doesn't measure up, we can recommend not funding those projects.

When it comes to security in an e-business or e-government setting, there's only so much you can do to prevent intrusion. You have to leave certain ports open to enable outside interaction with clients, partners, and citizens. So intrusion detection becomes critical to maintaining secure infrastructure. What initiatives are in place to ensure consistent intrusion detection and appropriate response to vulnerabilities?

A lot of this has to do with early detection and sharing information between agencies. A process is in place between my office, the CIO council and the Federal Security Research Center, which is now part of the Department of Homeland Security. We'll pick up a lot of threats ourselves and we'll pick up threats from the Homeland Security Department. These threats will be shared with the CIOs of all the agencies and with those who have operational security responsibilities. The system alerts me and the CIOs on the CIO council.

The first time we ran it, we had 90-minute cycle times. Slammer was the first vulnerability that raised the alert. The most recent was the Send Mail attacks using the IIS vulnerabilities, in early April. When people attack the federal government, they always include the White House Web site. At OMB, we have a terrific relationship with the White House CIO. From there, we make sure everyone's contacted.

From a policy perspective, IT security becomes a series of trade-offs. Various security practices, if taken too far, can violate the privacy of citizens. For example, if you're sharing information on a suspected hacker with various agencies involved in law enforcement, you may inadvertently violate certain rights. Could you describe the Administration's policies related to the trade-off between security and privacy?

We view this differently. We think that IT security and privacy tend to work in parallel. For the administration, civil liberties are the highest priority. If there are trade-offs, the decision is always made to protect the rights of the people. The policy makers and the IT workers are required to make this part of the business case, which is required by the e-Government Act, signed by the president last year.

In order to have privacy, you need good information security. Let me give you an example of how our efforts are improving the privacy of citizens. For so many years, so much private information was sitting around in file cabinets, boxes and so on. As that's moved to the digital realm, there are redundant sets of private information, which makes it much less secure. As you move more information solely to the digital realm, it becomes easier to protect privacy.

Once you've moved records to digital archives, do you destroy the paper archives?

It depends on the law. For example, in personnel records, when you move it to the electronic arena, there's a 70-year law. For every person hired into the federal government, no matter the length of the engagement, we are required to keep a file for 70 years. Meanwhile, we have a huge warehouse in Pennsylvania that contains a file on every federal employee. In other areas, it's moved more quickly.

One of the ways in which security and privacy go hand in hand is in making sure that citizens' private data (Social Security numbers, medical records, etc.) are only seen by the right eyes. What is your office doing to ensure that citizens who use e-government services are protected from identity theft?

Through the budget process again with the business cases. Agencies have to identify the risks and show that they've protected against it. If the agency can't validate to us that they've identified privacy and security, we put the system down as a project at risk, or not adequately defined. We don't let funds flow to that project until it has been adequately addressed.

Most of the critical telecommunications infrastructure for smooth e-business and e-government is controlled by private interests. How is the government working to guarantee that this infrastructure is secure?

We're working with the Department of Homeland Security to identify all critical infrastructure that might come under attack, not just telecommunications or Internet infrastructure.

We're collaborating with the White House Homeland Security Policy Office and Office of Technology Administration to ensure that these issues are assessed and adequately identified.