President Bush signed a directive this month that expands the intelligence community's role in monitoring Internet traffic to protect against a rising number of attacks on federal agencies' computer systems.

The directive, whose content is classified, authorizes the intelligence agencies, in particular the National Security Agency, to monitor the computer networks of all federal agencies -- including ones they have not previously monitored.

[...]

The classified joint directive, signed Jan. 8 and called the National Security Presidential Directive 54/Homeland Security Presidential Directive 23, has not been previously disclosed. Plans to expand the NSA's role in cyber-security were reported in the Baltimore Sun in September.

According to congressional aides and former White House officials with knowledge of the program, the directive outlines measures collectively referred to as the "cyber initiative," aimed at securing the government's computer systems against attacks by foreign adversaries and other intruders. It will cost billions of dollars, which the White House is expected to request in its fiscal 2009 budget.

[...]

Under the initiative, the NSA, CIA and the FBI's Cyber Division will investigate intrusions by monitoring Internet activity and, in some cases, capturing data for analysis, sources said.

The Pentagon can plan attacks on adversaries' networks if, for example, the NSA determines that a particular server in a foreign country needs to be taken down to disrupt an attack on an information system critical to the U.S. government. That could include responding to an attack against a private-sector network, such as the telecom industry's, sources said.

Also, as part of its attempt to defend government computer systems, the Department of Homeland Security will collect and monitor data on intrusions, deploy technologies for preventing attacks and encrypt data. It will also oversee the effort to reduce Internet portals across government to 50 from 2,000, to make it easier to detect attacks.

My concern is that the NSA is doing the monitoring. I simply don't like them monitoring domestic traffic, even domestic government traffic.

• TSA awarded the website contract without competition.

• The TSA official in charge of the project was a former employee of the contractor.    

• TSA did not detect the website’s security weaknesses for months.    

• TSA did not provide sufficient oversight of the website and the contractor.    

• The Site Was Not Hosted on a Government Domain.

• The Home Page Was Not Encrypted

• The Submission Page Was Not Encrypted

• Encrypted Pages Were Not Properly Certified

The revelation: “If it's got your company's name on it, it's your problem.”

At least, that’s according to the expert interviewed about taking responsibility when things go poorly.  In reality however, Mattel has received praise in the past for its responsible supply chain management — this is not an epiphany. 

Still, the company is taking steps to demonstrate its ongoing commitment with a new quality checking system and a responsibility organization to oversee product quality, labor standards, and sustainability...moves that CEO Robert Eckert calls “evolutionary, not revolutionary.”

But the lesson is a good one. It’s not just about managing outsourcers... it’s making sure they manage their outsourcers, and so on down the complex chain.  Whether it’s product safety, social responsibility, or information security issues, supply chain management is getting more in-depth, and necessarily so, as the number and potential imapct of risks increase.  For more on risk management with supply chain partners, check out Best Practices: Successfully Managing Security And Risk In A Global Supply Chain.