Cyber security and the story of my life

In preparing for testimony about how the government should be organized for protecting Internet communications, I suddenly realized how foolhardy I had been to join the launch of two out the three most recently created Cabinet departments. At this excerpt from the testimony shows, new government startups are nearly always doomed to years of disappointment before even partial success is likely. Since joining new government startups is pretty much the story of my life, it's fair to question my judgment.

Without intending it, I’ve become something of an expert in the process of creating new government organizations, having worked to establish two of the three most recent Cabinet departments. I helped Shirley Hustedler start the Education Department in the late 1970s, and at DHS, I started the DHS Office of Policy. That was a startup within a startup. The more I’ve seen of government reorganizations, the more skeptical I’ve become about their value, and I’m especially skeptical about the recommendation to create a NOC.

Let me explain why. There is a kind of lifecycle to proposals for new governmental organizations. In the first stage, proposals for organizational change begin to gain momentum -- almost always because the existing organization of government is flawed. After all, no one suggests changes when things are going well. Sometimes there’s been a shocking failure, such as the 9/11 attacks that led to the creation of DHS. Sometimes the flaw is a lack of governmental focus on a mission that seems more important than before, as with the Education Department. But we always begin with an existing organization whose flaws have suddenly become especially prominent.

The second stage, when proposals for organizational change become concrete, requires an exercise of imagination. The new organization has to be envisioned. Since the whole point of the new organization is to cure the failings of the old organization, I think it’s fair to say that the proponents of change never imagine an understaffed, overworked agency that drops balls. No. More or less by definition, an organization that does not exist does not have any flaws. So there’s a great temptation to give this new organization great responsibility. After all, the old agencies have sometimes failed, and the new agency has not.

Unfortunately, that’s only the second stage. In the third stage, the new organization actually begins work. In the glare of publicity it takes up its new responsibilities. But as a brand-new agency, it has to hire staff, find space, let contracts, arrange for IT support, and lease copiers, all before it can begin to carry out the missions that it has been assigned. Meanwhile, the agencies that lost ground in the reorganization snipe from the sidelines or make a bid to recapture their old turf. Six months after it’s been created, the new agency is still struggling to put in place the basic capabilities that any agency needs to function. Instead of the ideal organization imagined by lawmakers and commission members, the new agency is all too flawed. Only after years of effort does the reorganization begin to produce improvements that the outside world can see.

I’ve lived that cycle. I’ve helped write reports that called for the creation of new organizations to respond to existing agencies’ flaws. I’ve joined new organizations full of enthusiasm for the newly imagined perfection that they will embody. And I’ve labored to deliver perfection in offices that had no light bulbs, no staff, and no way to move paper around the office. It’s that experience that makes me dubious about creating a National Office for Cyberspace.