More Transcribed Interactions from USDOE CIO Danny Harris’ Hearing
On February 08, 2016, I published transcribed excerpts from the February 02, 2016, Congressional Oversight Committee Hearing of US Department of Education (USDOE) Chief Information Officer (CIO) Danny Harris.
In this post, I continue my transcription of select discussion from the three-hour hearing.
Let’s just jump right back in.
Regarding Harris’ receiving continued annual bonuses despite his department’s receiving an F for cyber security– and for his apparently never having achieved such security during his tenure as CIO– Harris had this to say (minute 45:30):
I’d also like to put my job as CIO in context, if I may.
Cyber security is absolutely critical to the federal government. However, it is only one of the mission-critical responsibilities under my leadership. Uh, for example, I run the entire financial management platform. Uh, we have received 13 clean audit opinions. We have an incredible IT investment management program. We have the best grants management system in the federal government.
One, I think, should look at the totality of my leadership and not just cyber– even though I agree the Department had a poor record–but again, it is only one aspect of my job– though it is a critical aspect.
Sooo, cyber security is critical, and Harris has never delivered on cyber security as CIO, but somehow, that should be excused (as should his over $200,000 in bonuses) because other aspects of his job have shown better results.
At minute 1:08:45, Rep. Fahrenhold addressed Harris as follows:
Uh, yeah. My concern is that you guys have pretty much every student’s social security number on file, probably including both of my, uh, my daughters. I’m old enough [that] you probably don’t have mine. So, this is something that, uh, that really is concerning.
Fahrenhold asks about Harris’ professional history, which Harris says began in IT. At minute 1:10:25, Fahrenhold takes issue with Harris’ apparent ineptness regarding cyber security given Harris’ declared IT background. Fahrenhold interrupts Harris as Harris is saying that he had 7 years experience in database administration work:
So, you’ve got, you’ve got to, you’ve should have, why didn’t you see some of this coming beforehand? Like, I mean, obviously hindsight is 20/20, but, uh, so, having, worked up in the trenches of the organization, and uh, you saw the headlines from Snowden to, why didn’t we see some of this coming and do something about, uh, it before it hit the fan?
So, as an IT professional, I am not a cyber security subject matter expert. And so, it is, it is true that the Department has been slow in making progress, and we’re happy about the progress we’re making now, but we need to make more…
But I mean, if you’re a former programmer, been messing with computers for years, in light of, I mean, when Snowden came out, didn’t something go off in your head, “Maybe we ought to make sure this doesn’t happen to us?”
Well, it’s a good question. I would like to say approximately six years ago, I met with then-Secretary Arne Duncan and indicated to him that I was very concerned about our IT security posture, and I asked him for funding to do the first-ever Department IT security discovery process. And that was really, in my opinion, the foundation of the Department staring to get really serious about cyber security.
But then, how did, how do we come to, uh, you know, just, less than, a few months ago, you’re an F?
Rep. Norton then has the mic. At minute 1:16:25, she asks Harris,
So, has your [job performance] rating suffered at all as a result of what now has been found to be the facts?
Harris responds, “No.” Norton continues:
So you continue to be rated “outstanding”?
Mr. King, uh, you see the problem that that may raise? Put yourself in the position of a federal employee, uh, and you look at how the rating apparently has not even been, been affected? Um, um, no violations of regulations. No violations of any kind found.
Um, could I ask you (King), in light of the fact that no violations were found, that apparently, there’s a finding that it was unclear whether Dr. Harris’ outside work constituted a business or a hobby, has it not occurred to the Department to clarify this so employees know what is the difference, and, and, so it will not be unclear for those who may have seen and known about this particular, uh, this particular matter, so that– don’t you think there’s rank confusion?
In the department, when they see a high-level official was engaged in outside activity for which there was remuneration but was unclear whether it was a business or a hobby? Doesn’t the Department have an obligation now to issue guidance so that these things are cleared up? … So, what it the answer? If the employee wants to know, “Look, I want to know. I don’t want to be caught in this thing too? I want to know, if I do this, would it be considered a business by the Department of Education or would it be considered a hobby?” Is there concrete guidance on that matter given what has happened here with an SES employee?
King responded that there is noting concrete; that the employee must take the initiative to seek guidance from the ethic officer, and that Harris apparently did not know to seek such guidance.
So, no, USDOE has not amended its ethics guidelines as a means to trying to ensure that the situation with Harris’ business-hobbies does not happen again.
Skipping ahead to Rep. Lieu at minute 1:33:50:
Thank you, Mr. Chair. I have a question for Mr. King.
A number of times this morning you have said that, um, you believe Mr. Harris engaged in a hobby rather than a business venture. When I think of a hobby, I think of someone collecting stamps or building model airplanes or maybe gardening. I am not aware of any hobby known as installing theaters in other people’s homes for a profit.
Are you aware that in this case that there was a business card, “Harris Audio-visual Innovation,” which included a company logo and listed Daniel A Harris as owner and operator. Are you aware of that? Obviously, yes or no?
King said that he was only aware of Harris’ business card as he saw it in the file as he prepared for the February 2016 Congressional hearing. Lieu continues:
Second question: Are you aware that he paid two employees to do these installations in other people’s homes?
King acknowledges knowing that Harris had two employees “involved in this activity.” Lieu continues:
Now having known this, do you still believe he engaged in a hobby rather than a business venture? Just a yes or no.
As he tries to do throughout the hearing, King tries here to dodge any ultimate responsibility for a King-initiated decision regarding Harris’ continued employment as USDOE CIO. He tries to go back to the “findings of general counsel.” Lieu interrupts:
Let me just stop you there. Let me stop you there. Let me tell you how it works. And I know something about this because I was an active-duty JAG in the military, still in the reserves. I’m a military attorney.
The way it works in government, attorneys give advice. You make the decision. Attorneys don’t make the decision. You do.
In this case, I want to know your view. Now knowing these facts, did he engage in a hobby or a business venture?
John King refuses to answer for himself and insists on regurgitating the cop out, “I credit the judgment of our general counsel,” which he has been parroting for much of the hearing. Lieu insists:
Let me tell you how it works:
You are not a rubber stamp for your attorney. That’s not how it works. If you think that’s how it works, then you need to re-evaluate. …
Outside this bubble of Washington, DC, the rest of America would view what Mr. Harris did as violating a law or rule or regulation. Uh, for you to not find that was simply an error. It was a mistake because your job is not to protect Mr. Harris. It is to send a proper tone, standards of conduct and leadership for your agency, and you have now sent the message that you can operate a business venture, not report that on your ethics forms, not report the income on your tax filings, and that does not violate a law, rule, or a regulation.
That’s simply ridiculous, and you cannot use a shield of relying on some recommendation of an attorney. It is your decision. It is your job to make the correct decision. You made the wrong one.
At minute 1:43:30, Rep. Walker calls Harris on communicating in 2015 that cyber security issues had already been 100 percent addressed even though they were not. As Walker is taking to Harris, he turns to King:
[To Harris] Well, it appears to us that when the light is shown on these deficiencies, or you start bringing these grades of concurrent F’s, that you’re willing to do something [about cyber security.] Mr. King, you’re fidgeting over there like you’re wanting to jump in. What, what do you have to say on this?
Yes, sir. The, the Department had previously used a Level 3 goal. That goal was changed to Level 4. And, I joined the Department in January 2015, began meeting regularly with the team on how we might improve our, improve our cyber security for the sprint. Um, we began meeting weekly to ensure that we would get to Level 4 across the, the agency. In the federal student aid area, we have a number of external contractors. They use PIV-I. In order to get to 95 percent, we needed to amend nearly 60 contracts, ah, which we did with external vendors, provided technical assistance to those external vendors. That’s why we’re at 95 percent. So, I just want to convey again the urgency that we brought to this matter throughout my time at the…
Yeah, yeah, you’ve been conveying, and almost, to me, you look like you’re trying to cover up here. I think the congresswoman from DC, Ms. Norton, really brougth it to a point here, saying there’s no consequences for the actions. The people get scored; your grade didn’t change at all, you’re still getting high marks (a reference to Harris’ evaluation). And I think it’s, the irony of all of this is this is education. So what in the world are we teaching our children? There’s no consequences for their actions?
Mr. King, you’re, you’re today, you’re still defending the actions like this is no big deal. I don’t, I don’t understand that. It, I want to ask you right now, I want to come back to this: Under oath, are you still saying to me, and to this panel, and to the American people, that you do not believe that any standard of ethical conduct was breached? Is that your testimony?
My testimony was that I saw significant lapses in judgment; that I counseled Dr. Harris…
That’s what you said. Do you believe that today or not? Do you believe that any ethical standard of conduct was breached or broken?
I do not believe there was a law or regulation or policy of the Department; however, I do believe there were significant lapses in judgment. I counseled Dr. Harris on those. That was the fourth counseling that he received on that matter…
So, lapses in judgment [vs] ethical conduct: Do those two merge at all, or are those two separate things? You sit here today and you blame it on your general counsel and lawyers for not taking a position of leadership and holding the people accountable. [King: “No, sir…”]
Do you understand why the American people are frustrated with this?
I disagree with that characterization. I took it very seriously. That’s why I engaged in additional counseling of Dr. Harris. That’s why I asked that the counseling he received from the ethics officer to be put in writing…
You took it very serious? What actions did you take toward Mr. Harris?
Of course, we all know the answer: Counseling.
Jumping ahead to Rep. Meadows’ questioning of the delay between the April 2013 IG report on Harris and the March 2014 ethics officer response (minute 2:05:22):
Can either of you, Ms. Winchell, Mr. King, explain to me why, why the Inspector General gave you a report on April of 2013, and they had to do a follow-up two years later and said that they had never heard from anybody? Why, why would that be? Mr. King, you may want to answer since it was directed to you on March 23rd of 2015. In response, It says, and I quote, “To date, we have not received a response from the Office of the Deputy Secretary concerning the findings that they gave on April 2nd, 2013.” Why, why would they have not had a response in two years if you take it seriously?”
When I joined the Department in January of 2015, the IG explained that there was an addendum to the report that was forthcoming…
But that’s not what this is saying. I’m, I’m going back to the original report, when they put in the report on April 2nd of 2013, you know what they heard from you guys? Crickets! Not a single, dad-gum response!
[To Ms. Winchell, who said she heard “from the IG that the offending conduct had ceased”] How, how, how did you figure that out? Who talked to Dr. Harris? Because you didn’t talk to him according to your note until a year later. … According to your memo, you didn’t talk to Dr. Harris until March 12th of 2014– almost a year after the, the IG submitted a request. Why would it take a year? …
So, you’re in charge of ethics, and you’re taking someone else’s word that the conduct has ceased a year later?
Deputy Secretary Miller, after receiving the initial IG report, consulted with the Office of the General Counsel and spoke directly with Dr. Harris, giving Dr. Harris counseling…
And said it was okay?
No. Giving him counseling that there was a…
How is that your understanding? Did you talk to Dr., uh, uh, Tony Miller about that?
That’s my understanding from the staff at the deputy secretary’s office [that] overlapped from…
Mr. King, let me tell you what’s troubling here. I don’t know if Dr. Harris’ actions are the most troubling or your cover-up of it is the most troubling, Mr. King, because let me, let me tell you the concern I have. Everybody can make a mistake. But the minute it was put forth by the OG, everybody– Ms. Winchell and Mr. King– you should have been all over this and saying that this is a problem. And let me tell you the reason why I, I’m so concerned:
I’ve been visiting federal employees. And, you know what? I constantly hear is that there’s a double standard for the people at the top and the rank-and-file federal workers. And today, listening to this testimony, I, I tell you, I hope they’re not watching because they would use a different word for bovine waste than what is used here.
I tried to be clear that I took this very seriously, I…
No, you haven’t, because your responses, I would disagree, Mr. King, because your responses indicate that nothing has happened in terms of retribution. No one’s been fired. In fact, you approved a big bonus for Dr. Harris. No, there’s been no consequences, so I disagree.
There have been consequences.
What’s the consequences?
There have been four counseling sessions….
Okay. So, his consequence is that he’s had counseling sessions…. With the indulgence of the chair, I’ll finish with this: president Obama signed an executive order a few weeks ago on Second Amendment. The guidance with that said that if you have a business card, you’re in the business of selling firearms. So, in light of that, Ms. Winchell, is the President wrong, or are you wrong?
Ethics officer Winchell continues to maintain that according to the IG report, Harris’ activities qualify as hobbies.
Two notes as I close this post:
First, the issue of Harris failure to adequately achieve cyber security extend back to Margaret Spellings’ time as US Secretary of Education and span Arne Duncan’s entire tenure in that same position.
Second, the Harris situation is a glaring illustration of USDOE dysfunction, including the reality that USDOE operates capriciously via its own double standard. In this hearing, King has made it clear that he plans to stick to his rehearsed, lame excuse for the continued employ– with bonuses– of a man who is in charge of cyber security but who has repeatedly failed at that goal.
There is still 50 minutes to go in this three-hour hearing.
My above transcription ended at minute 2:11:05, with Congressional Oversight Committee Chair Chaffetz again launching into King for maintaining that Harris demonstrated “no violation of law, regulation, policy, or ethics.”
Let’s end with Chaffetz at minute 2:17:03. Chaffetz is clearly tired of hearing King repeat his excuses for Harris
Chaffetz is speaking to King:
Again, you’re looking at an Inspector General report that comes out mid-year; criminal referrals; every single metric is down; ten systems still to this day with expired authorities to operate; one has PII information; 54 unsupported software systems. You have an Inspector General who can go in there, ah, undetected into the system. You have 139 million social security numbers.
And this guy gets a bonus.
This is why we have zero confidence in you, personally. Zero.