Government contracting culture impedes progress in cybersecurity.

• Author: Datla, Anand
• Position: DEFENSE BUSINESS

* Damaging attacks on Defense Department and private-sector networks have filled news headlines. They also prompted the Obama administration to appoint a national cybercoordinator and the Pentagon to create a Cyber Command.

But these initiatives still don't address foundational issues that will certainly impede any progress. The biggest problem by far is that the U.S. government lags far behind industry in ensuring quality of service for its network infrastructure. In other words, the current acquisition culture makes it difficult to harness resources in support of cybersecurity.

This largely is the result of institutional practices, particularly in the way the Defense Department acquires information technology.

[ILLUSTRATION OMITTED]

The government already is spending billions of dollars on IT products and services but does not hold its vendors accountable for cyberintrusions. The current contracting practices also fail to provide financial incentives to contractors to protect government networks from attacks.

Contracting typically is measured in terms of a service or a weapon system that the government is purchasing. Most contract types used today were designed to lower the risk to the government depending on the requirements, but they are not structured to reward or punish contractors for poor performance. This is a problem when it comes to cybersecurity.

The contract acquisition types that have stood out over time are known as "time and materials" and "labor hours." Time-and-material contracts are primarily concerned with acquiring services for the government without knowledge of the required duration to finish the work. Similarly, labor hours are an acquisition of services, the only difference being that the government supplies all the necessary materials.

These contract mediums were used in eras when systems were closed networks and grew at a linear pace. An example was the CSC Infonet in the 1970s. Infonet was a large network with hundreds of users. The focus was more on supporting infrastructure development needs instead of ensuring quality of service.

In the decades since, there has been a continued push to make it easier for the government to be able to access commercial technology. To support this effort, legislation such as the Federal Acquisition Streamlining Act of 1994 and the Clinger Cohen Act provided measures so acquisition services could be obtained faster.

In this context, the Defense Department's cyber-efforts have been...