Top Pentagon cyber official under probe over disclosure concerns

WASHINGTON • The Pentagon official who has been overseeing its new cyber-security initiative for defence contractors has been placed on leave in connection with a suspected unauthorised disclosure of classified information from a military intelligence agency, according to an official document.

Ms Katie Arrington, chief information security officer for the Pentagon's acquisition and sustainment office, was informed on May 11 that "her security clearance for access to classified information is being suspended" as "a result of a reported Unauthorised Disclosure of Classified Information and subsequent removal of access by the National Security Agency", according to a memo.

The National Security Agency, which is part of the US Defence Department, gathers some of the nation's most sensitive signals and eavesdropping intelligence from foreign adversaries.

"If this preliminary decision becomes final, you will not be eligible for access to classified information" or "assignments to duties that have been designated national security sensitive," the memo from the Office of the Undersecretary of Defence for Acquisition and Sustainment said.

It provided no details about the possible disclosure of information.

Ms Arrington's attorney, Mr Mark Zaid, confirmed the content of the memo. "She has neither been fired nor had her security clearance revoked," he said. "We look forward to an opportunity to completely clear her name."

Ms Arrington is a former two-term Republican state representative from South Carolina, who was brought into the Pentagon in 2019 under the category of "highly qualified expert" and later attained the nonpartisan senior executive service status, Mr Zaid said.

Her official Pentagon biography says she has more than 15 years of cyber experience "through positions at Booz Allen Hamilton, Centuria Corporation, and Dispersive Networks".

A US official familiar with the case said Ms Arrington's politics - as a Republican under a Democratic president - is not a factor in the investigation, and that it is not an attempt to force her from the Pentagon.

The official, who discussed the case on condition of anonymity, also said the investigation is not connected to Ms Arrington's management of the Pentagon's ambitious Cybersecurity Maturity Model Certification system, which is being slowly implemented as Deputy Defence Secretary Kathleen Hicks reviews the programme inherited from the Trump administration.

In 2019, Ms Arrington took over implementing the programme and building industry support for its complex certification process.

She quickly emerged as a skilful ambassador, speaking at dozens of events to sell the programme to the defence industry, according to Bloomberg Government analyst Chris Cornillie, who has studied the programme.

Under the certification programme, every company in the defence supply chain - as many as 300,000 American firms producing everything from F-35 fighter jets to plumbing equipment - must undergo a cyber-security audit performed by a third party about every three years overseen by an "accreditation board", Mr Cornillie said.

BLOOMBERG