Davis questions involvement in CISO Exchange

House Government Reform Chairman Rep. Tom Davis (R-Va.) is re-evaluating his involvement in the CISO Exchange, a newly formed public-private partnership for federal chief information security officers, because of concerns over fees to be charged to industry participants and about the group's structure, his spokesman said today.

"After learning more about recent developments pertaining to the CISO Exchange, Davis is in the process of re-evaluating his relationship to the program," said David Marin, deputy staff director for the reform committee.

Davis is co-chairman of the CISO Exchange. Melissa Wojciak, the Government Reform Committee's staff director, is co-chair of the exchange's advisory board.

Since the exchange's advisory board was named April 6, Davis has become concerned about the $75,000 fee to be paid by the six industry members of the exchange's advisory board, Marin said.

"That's the concern," Marin said. "We don't want any role or input in any fees. We were not aware of fees being charged."

Davis "wants to make absolutely sure that no one infers that the committee's name or resources are being used to support a commercial endeavor, or that the committee's role will imply that any work product produced will somehow have the committee's imprimatur on it," Marin said.

Davis also is worried that the structure of the exchange may appear to give some industry participants exclusive access to him. Davis does not want "any would-be sponsor to believe that sponsoring the exchange means they will have an inside track to him or committee staff," Marin said.

"We're working on a way to address these concerns while continuing to support the exchange and its important goals," Marin said.

Earlier today, Marin said Davis was considering resigning from the group, but Marin later amended that statement. "He is not resigning, per se; that would imply he wants nothing to do with the exchange," Marin said. "In fact, he plans to address the group, and a staff designee will participate in as many meetings as possible."

Davis initially announced the CISO Exchange in February following the release of the Reform Committee's annual report card on federal information security. As a joint project of the committee and the Federal Chief Information Officers Council, the exchange's purpose is to share information with private industry executives about how to improve data security.

The exchange is being managed by Stephen O'Keeffe, president of public relations and marketing firm O'Keeffe & Co. of Alexandria, Va.

On April 6, the CISO Exchange named an advisory board, to be co-chaired by Wojciak and Vance Hitch, Justice Department CIO. The panel's advisory board members are six federal chief information security officers, from Homeland Security, Defense, State, Treasury, Justice and Housing and Urban Development, and two private industry fellows, from Computer Sciences Corp. of El Segundo, Calif., and NetSec Inc. of Herndon, Va.

There are four vacant seats on the advisory board that are being offered to "qualified systems integrator and solution providers that serve the government IT market," according to the CISO Exchange's website. "CISO Exchange Fellows serve on the CISO Exchange advisory board alongside Federal CISOs for a period of one year." The cost of the industry fellowship, which includes the privilege of sitting on the board of advisors, is $75,000, according to O'Keeffe.

The group will hold four meetings a year, closed to the public, and will produce an annual report on solutions to federal IT security challenges, O'Keeffe said.

For $25,000, industry participants have the opportunity to submit ideas and suggestions and contribute to development of the annual report, along with other benefits, and for $5,000, industry affiliates can have access to some CISO documents, and the opportunity to take part in a lottery that will allow winners to attend CISO Exchange events, O'Keeffe said.

Asked how the group was created and what the money will pay for, O'Keeffe said it is a "holding company" of his management firm. The fees will pay for his firm's hourly management fees to "facilitate" the exchange activities, and for staff time in preparing materials and reports, he said.

"We've made every effort to structure this appropriately," O'Keeffe said. "The fellows are integrators and service organizations, not vendors," to avoid "vendor bias." Furthermore, he said, "this is not a policy group, it's operational. We will not be getting involved in policy issues?We won't lobby anyone."

O'Keeffe said the group's structure is needed to break through a longstanding stalemate in improving federal information security reflected by the consistently poor report card grades for such efforts given by Davis' committee. "We've been at the status quo too long. The CIO Council is frustrated. The CISOs are frustrated. We need to provide a forum to move this forward," O'Keeffe said.

But several academic and industry experts say it's highly questionable to charge a high fee to industry participants in a public-private partnership with top-level government officials.

"If the government and Congress want to meet, that's fine, but why do they want to charge the private sector $75,000 to show up?" asked Steven Cohen, vice dean of Columbia University's School of International and Public Affairs. "In New Jersey, that would be called pay-for-play."

"The problem is you have important government officials showing up, lending time to a profit-making enterprise. That's a potential ethical breach," Cohen said.
Bob Woods, executive chairman of the Industry Advisory council, an industry group representing IT companies, said he was troubled by the idea of closed meetings and high fees.

"These are closed meetings where you pay your way in, and a mix of people doing oversight and the people overseen," Woods said. "The atmospherics don't look good." However, he said, "I don't want to be too critical without knowing more about the group."

O'Keeffe, however, defended the exchange, saying that other private-sector initiatives bring together industry and government executives in a similar manner. "There is a clear precedent for government executives participating in private-sector, sponsor-funded initiatives," he said.

Marin said Davis did not create the group under the committee's or his own official authority, but rather was approached by the private sector and asked to participate in the group. "The chairman saw it as an opportunity to foster an exchange of ideas," he said.

However, the group's structure that evolved between February and April "is, frankly, not what we expected," Marin said. "We envisioned it as an informal gathering or a lunch."

Marin said the chairman now wants to make sure that the exchange is not perceived as "an exclusive entity to control access to the chairman, his staff or the work product. That clearly creates problematic issues," Marin said.

"We want to continue to support it, but to make sure of the appropriateness," said Marin.