Federal Agencies Told To Budget For IT Security

When it comes to computer security, the federal government wants to lead by example, national cybersecurity czar Richard Clarke said last week.

As part of that goal, the Bush administration will require federal agencies to allocate funds to computer security in their annual budgets, said Clarke, who was named special adviser to the president for cybersecurity in October and is chairman of the President's Critical Infrastructure Protection Board. "The government has to set a better example, and we will," he said.

The new spending policy is outlined in letters sent last week from the White House's Office of Management and Budget to federal agencies. If an agency doesn't include IT security spending on its budget, the OMB will send the budget back with appropriate levels of spending earmarked for IT security, the directive says. It's unclear just how much each agency will have to spend, but if there's no money specified in an agency's budget, OMB will deduct funds from other areas.

IT security "is a priority focus for us and always has been," says an official at the Federal Deposit Insurance Corp. in Washington who requested anonymity. The FDIC budgets for IT security, but it can't pinpoint the dollar amount because that money is included in other IT purchases. But some agencies aren't as attentive to security and might benefit from the directive, the official says.

Adding funds for IT security won't translate into more-secure systems unless the money is spent wisely. Says Pete Lindstrom, a senior analyst at Hurwitz Group, "You need money, but there's no direct correlation between level of security and dollars spent."

The federal government also plans to open by January a national simulation center to study how a terrorist attack on the country's IT systems or other parts of its critical infrastructure will affect interdependent systems. Clarke described the center as "an acupuncture map of the country" that will simulate how pressure on one system can spill over into other areas.