June 2003

Cyber Corps' Failing Grades

Federal officials are revamping the infosec training program to resolve critical job placement problems.

BY Vin McLellan

Federal administrators are overhauling Cyber Corps because conflicting policies and management structures are making it increasingly difficult to place graduates of the infosec training program in government jobs.

University coordinators say getting the first 50 Cyber Corps graduates into federal jobs proved extremely difficult. Federal agencies were unwilling to hire inexperienced security admins when more senior infosec positions went unfilled. Complicating the situation is the Office of Personnel Management (OPM), which is responsible for placing students but has little authority to compel placements.

"I don't pretend to understand how government works," says Douglas Jacobson, an Iowa State professor who advises 22 program participants. "I don't even know whom to blame, but there's clearly a problem here. The people doing the hiring don't seem to have a stake in the process."

Changes under consideration are said to be radical, given the broad nature of the problems hindering Cyber Corps. Officials are still working on details, but it has already been decided to reorganize Cyber Corps based on the Department of Defense's Information Assurance Scholarship Program.

"We are in the process of building the mechanism and redesigning the process to make it happen," says Miguel Hernandez, an OPM administrator who oversees Cyber Corps placements.

Placement Problems
Faced with a shortage of infosec professionals in its ranks and an inability to compete with private-sector salaries and benefits, the government launched Cyber Corps in 2001 under the scholarship for service model. Students receive tuition and a stipend in exchange for serving in a summer internship and working at a government agency for up to two years.

Cyber Corps has distributed nearly $30 million to upgrade university infosec programs and fund scholarships for 200 students at 13 universities certified as Centers for Academic Excellence by the National Security Agency.

The first class of 50 students graduate this year, with 150 remaining in the program and another 100 entering this September. Cyber Corps is expected to train 100 infosec professionals for government service every year. Despite enthusiastic support from the White House and Capitol Hill, getting entry-level graduates hired by federal agencies turned out to be "a daunting logistical and bureaucratic problem," says Ernest McDuffie, a lead program manager at the National Science Foundation.

Federal agencies have been resistant to hiring Cyber Corps graduates because of tight budgets, confusing OPM guidelines, concerns about limited retention, and the cost and time required to obtain mandatory security clearances. That, in turn, has left many students discouraged.

"Some are understandably bitter," says Eugene Spafford, director of Purdue University's Center for Education and Research in Information Assurance and Security and co-chair of the Association for Computing Machinery's Public Policy Committee. "Many more are just frustrated."

All but one of this year's graduates got a job. But, campus coordinators worry that many of next year's class will have even greater trouble fulfilling their service commitment. Students unable to find a federal job at no fault of their own are released from their service obligation. Critics say the failure to place Cyber Corps graduates is both a waste of talent and tax dollars.

"This program has been in such disarray that it has been just short of criminal," says Raymond Vaughn, a computer science professor who coordinates the Mississippi State University program.

Worse, in the short term, are the problems many of the mid-term Cyber Corps participants have had finding summer internships. "The OPM has been unable to place me, or anyone I know, in an internship," reported one University of Idaho student, who did not want to be named.

Cyber Corps proponents, many senior federal officials, say such problems are expected with new programs.

"We've got to learn to walk before we can run," says Daniel Mehan, CIO of the Federal Aviation Administration and a staunch advocate of the program. "It'll work out."

Process for Failure
The Office of Personnel Management has taken the brunt of the criticism for Cyber Corps' shortcomings.

One senior federal executive, who wished to remain anonymous, said OPM had promised more than it could deliver, especially since hiring is done at the agency level. Others suggest that OPM got tangled in its own regulations and gave confusing guidance to federal agencies on Cyber Corps placements.

For example, OPM had recommended that agencies hire Cyber Corps students under a regulation that required each student to work a 640-hour internship, even though federal summer internships are only 480 hours. OPM recently changed its guidelines on Cyber Corps internships, recommending placements under its "R" authority, which allows for "fellowship or related programs" for a period of no more than four years.

"OPM just wasn't there for these kids," says Donald McGillen, executive director of the Center for Computer and Communications Security and Cyber Corps coordinator at Carnegie Mellon University.

Although individual OPM officers tried to make an unworkable system perform, McGillen and others says the campus coordinators generally felt that they were responsible for arranging internships and post-graduation jobs.

Change in the Making
After a year of increasingly bitter complaints from participating universities and students--capped by direct intervention by the White House--the Interagency Coordinating Committee (ICC) launched a reorganization of the Cyber Corps program in March.

ICC plans to get federal agencies involved in the initial selection of Cyber Corps scholars and commit earlier to job placements. ICC met again late last month to fine-tune its reorganization plans.

The most likely vision, officials say, is remodeling Cyber Corps after DoD's Information Assurance Scholarship Program (IASP), in which federal agencies have a direct hand in selecting students for scholarships. Agencies sponsor specific students in the expectation that they will hire them after graduation. Currently, universities select Cyber Corps participants.

IASP also gives educational grants to both DoD career employees and college students DoD targets for recruitment. The dual mission gives IASP a broader base of support within DoD.

If adopted, the remodeled Cyber Corps will force participants to exchange flexibility for job placement security. Officials say the proposal isn't palatable, but necessary to correct the placement problems. "The changes won't please everyone," says OPM's Hernandez.

June 2003 Table of Contents

Copyright 2003 TechTarget