From: Foreign Policy

Posted By John Reed

Last week, Rep. Mike Rogers (R-Mich.) slammed the Pentagon program allowing some businesses to share information on cyber attacks with the government and receive help in defending against those attacks. Rogers claimed that since being expanded to include the Department of Homeland Security, the DIB-pilot project, as it’s colloquially known, has been bleeding members.

“The president said about a year ago that we want to have a thousand companies engaged in the DIB pilot. That was about a year ago. This oughta say everything we need to know…guess how many companies we have participating?” asked Rogers during a speech at the U.S. Chamber of Commerce. “I’ll tell you: less than 20. We’ve lost somewhere between five and seven companies, no gains, no effort to get more people involved.”

The only problem with his very public statement? It’s wrong, according to Pentagon officials, who have been claiming over the last month that companies have been lining up to join the overall DIB program — called the Defense Industrial Base Cyber Security Information Assurance program (DIB CS/IA).

When we first wrote about Rogers’ comments last Friday, a Pentagon spokesman said this was the first he’d heard that any part of the program was struggling. Over the long weekend, we received more info from the Defense Department.

It turns out that specific the subset of the DIB program Rogers was talking about — officially known as the DIB Enhanced Cybersecurity Services (DECS) program — didn’t have 20 members when it was in pilot mode, it had 17, and it has kept those members.

“The DIB CS/IA program has an optional component, called the DIB Enhanced Cybersecurity Services (formerly the DIB Cyber Pilot), which is a DoD-Department of Homeland Security partnership,” wrote a Pentagon spokesman in an email. “In September 2012, DoD made DECS available to all companies participating in the DIB CS/IA program. Seventeen companies participated in the DIB pilot and continue to participate in DECS. Under DECS, DoD, via DHS, provides classified cyber threat information and technical countermeasures to DHS-authorized Commercial Service Provider (CSP), who can then provide a fee-based managed cyber security service to interested DIB CS/IA companies.”

(Here’s the plain English explanation of DECS: Defense companies who sign up for it — yes, it’s a pay-for-services program — get protection against cyber threats from their Internet providers. These providers have received information on malicious Internet signatures identified by U.S. intelligence agencies as well as “technical countermeasures” from the intel agencies to defend against these threats.)

So while DECS hasn’t grown since being opened up to a broader number of companies last month, it hasn’t lost five to seven members as claimed by Rogers.

Keep in mind that the Michigan Republican, who chairs the House intelligence committee, is pushing the Senate to pass a controversial bill allowing for broad information-sharing between private companies and the government in near real-time and protecting them from lawsuits for improperly sharing private citizens’ information. Arguing that the Pentagon’s current info-sharing program isn’t working would only bolster his push for legislation.

According to the same Defense Department spokesman, the overall DIB program (DIB CS/IA) has more than 60 companies and 80 subsidiaries participating, with more applying to join each week.

“DoD opened the DIB CS/IA program to all eligible DIB companies in May 2012 with the publication of a federal rule,” said the Pentagon spokesman. “Over 60 companies and approximately 80 wholly-owned subsidiaries now participate in the DIB CS/IA program. New companies apply to join the program each week. DoD estimates that the companies currently participating represent roughly 70 percent of” big defense contractors where DoD spends its weapons buying cash.

Under the basic DIB CS/IA program, DoD provides defense contractors with classified and unclassified cyber threat information and advice on best practices for keeping their information safe. DIB participants, in turn, report cyber incidents for analysis, coordinate on mitigation strategies, and participate in cyber intrusion damage assessments if information about DoD is compromised.