before Sept. 11," Sherwood said, admitting the privacy focus has shifted. "I spend a great deal of my time talking about security."
Utah has implemented a firewall initiative, installed intrusion detection systems and, by order of Gov. Mike Leavitt, launched a Homeland Security Task Force. Although the state had an early start in the security arena, Sherwood admitted the September events had an immediate impact. "It really sped up the deployment of plans we already had in place," he observed.
Near the hub of terrorist activity, West Virginia was also early to adopt a security focus. The priority came with the January 2001 appointment of chief technology officer Keith Comstock. "A lot of my background has been supporting federal clients, particularly in the Department of Defense, and so I came with a certain mindset about protecting data," he said in an earlier interview with the Center for Digital Government. "One of the things I did when I came in here was to hire a security officer, and at that time I got a lot of strange looks. Now, I'm having to re-examine where I was - I wasn't being strict enough."
Since Sept. 11, Gov. Bob Wise approved crisis funding for security enhancements and a liaison with the federal Office of Homeland Security. West Virginia state employee ID cards have been reissued and National Guard troops have been deployed to guard airports. Comstock said the state did a security assessment early last year and found that 89 percent of 5,000 passwords tested were cracked in five minutes or less, and 30 percent of desktop machines contained unauthorized software. Those conditions were quickly corrected. [Query to Production: Can you represent this graphically?]
Comstock said the state's top 10 security priorities include business continuity planning, screening of personnel and issuing security clearances, activating intrusion detection systems, increasing the use of biometrics, recruiting security officers and other priorities. Comstock said simple directives, such as making sure doors are locked and server racks are secure, need to be enforced. "There are no easy answers," he said. "You need money, leadership and political capital to make the necessary changes."
The state's information security officer, Steven Lee, speculated that electronic government initiatives will move forward, rather than be stalled as states seek to respond to new demands. "I do see that there is going to be a complete buttoning down of systems," he said. Nonetheless, he expects a renewed demand for e-government services. "I don't want to speak for the governor, but the promise he's made to the citizens is to create an e-government initiative that brings government closer to the people through technology, and in doing so, make absolutely sure there is security," Lee said.
While other state and local governments looked at homeland security from a mostly theoretical platform, the city of New York was dealing with reality. Avi Duvdevani, acting CIO for the city, agreed that Y2K planning provided critical support throughout the crisis. A four-step plan for business continuity had already been designed and tested.
The plan, which covered facilities, PCs and servers, labor and network connections, was used occasionally prior to Sept. 11 for fires and electrical outages, according to Duvdevani. When the Twin Towers fell, the plan continued to work even though the scale of the disaster was unprecedented.
"One of the most devastating consequences from the technology perspective was the impact on the city's telecommunication infrastructure in the city center area," Duvdevani said. Ironically, the attacks happened just days after Duvdevani, a 20-year veteran of city-service, was named acting CIO. After the attacks, he said, police headquarters, City Hall and many other buildings were forced into "total communication darkness" when Verizon's central office was impacted by the collapse of building seven of the World Trade Center, the building that housed the city's emergency-management command center.
The communications shutdown hit more than 50,000