010815as1

information, which can be used to weaken our government’s defenses or to exploit citizens’
personal information.
There is even a threat that adversaries could use cyber-attacks to disrupt or destroy
information systems, including those that support the operations of critical infrastructure, to
conduct real world damage, even potentially including loss of life. Former DHS Secretary Janet
Napolitano publicly warned of the danger of a “cyber 9/11” attack and others have warned of
“cyber Pearl Harbor”. 371 These warnings may overstate the probability of such an attack. In
2014, DHS officials told Committee staff that it is “very difficult to kill people” 372 using cyberattacks
and that the greater concern of cyber-attacks on critical infrastructure is economic
consequences. The potential for a cyber-attack that causes loss of human life remains a lowprobability
high-consequence event that must not be ignored.
The Department of Homeland Security has assumed significant responsibilities in the
area of safeguarding and securing cyberspace. The Department defines this as its fourth priority
mission: “DHS is responsible for protecting the federal executive branch civilian agencies and
guiding the protection of the nation’s critical infrastructure.” 373 DHS currently operates
extensive programs across several of its components and directorates focusing on cybersecurity,
including programs within the National Protection and Programs Directorate ($696 million
annually) and the U.S. Secret Service ($9.8 million annually), and ICE’s Homeland Security
Investigations component. 374 Overall, the Department spends nearly $706 million annually on
cybersecurity-related federal programs. 375
A review of DHS’s cyber security programs raises questions about whether the
Department is effectively fulfilling its cybersecurity mission, as well as whether its strategy for
helping the nation safeguard and secure cyberspace is appropriate given the nature of the threats
we face. First, the Department of Homeland Security has struggled to execute the
responsibilities delegated to it by the Office of Management & Budget for improving the
371 Reuters, “U.S. homeland chief: cyber 9/11 could happen "imminently",” January 24, 2013, at:
http://www.reuters.com/article/2013/01/24/us-usa-cyber-threat-idUSBRE90N1A320130124.
372 DHS officials briefing Committee Staff, April 17, 2014.
373 “Department of Homeland Security Strategic Plan: Fiscal Years 2012-2016,” Department of Homeland Security,
February 2012.
374 Memo from Congressional Research Service to HSGAC Minority Staff, “Historical Trends in FISMA Spending
by Federal Agencies and Recent Cybersecurity Investments by the Department of Homeland Security, ” November
13, 2014. Data on ICE-HSI expenditures related to cybersecurity was unavailable due to the structure of ICE-HSI
and its funding.
375 Id. As of FY2013, NPPD had 348 FTEs in these programs.
82