Big data bigwigs cash in

120423_cybersecurity_ap_328.jpg

Many of the biggest players tasked with protecting the country after Sept. 11 have a new mission, and one that pays: securing all of the data the corporate world collects on its customers.

Ex-Cabinet chiefs Tom Ridge and Michael Chertoff count Fortune 500 companies among their clients anxious to secure computer systems and avoid the fate of Target, the victim of an epic data breach last fall. Former Capitol Hill lawmakers and senior staff central to the last decade’s battles over privacy and security have traded their top-secret government clearances for lucrative jobs as consultants and lobbyists. Retired Gen. Keith Alexander, the former National Security Agency director tarred by Edward Snowden’s leaks, launched his own firm this spring, just weeks after leaving government.

Big Data is now comfortably entrenched in the revolving door of Washington’s influence industry.

( Also on POLITICO: Booker, Paul join on ‘common sense’)

A POLITICO review of the industry found lobbying on cybersecurity, privacy and other data issues has skyrocketed over the past decade, with a more recent hiring spree driven by the Snowden scandal and major security breaches at some of the country’s largest companies. Dozens of boutique firms and established K Street players are entering the red-hot market and touting their top recruits from the executive and legislative branches.

The rush to embrace corporate America has prompted complaints from government surveillance critics that the country’s former security officials are now selling their secrets. But the threats also are very real — brought home by the recent data breaches at Target, Neiman Marcus and Michaels — and include the haunting worst-case scenario of frozen financial and retail markets.

“I thought I was going to take three months off to see if I still had a golf game,” Alexander said in an interview. Instead, he was meeting with Wall Street executives and other potential clients for his new business, which he defends as the next logical step after a four-decade military career.

( Also on POLITICO: Terror center director leaving)

“It wasn’t me saying, ‘Wow, I can go make a lot of money doing A, B, C and D,’” Alexander said. “I do think, like everybody else, I have some great insight in this area. I’ve spent a lot of my life working in it, and it makes sense that I do everything I can to help industry build a more defensible architecture.”

Alexander brushed off criticism from Capitol Hill and elsewhere of his quick move to the private sector. “A doctor who works at Walter Reed who’s a brain surgeon and retires, and he’s a world-class brain surgeon, would you find it acceptable that he could go to the Genome Center in Manhattan and work there?” he said.

It’s the same “great insight” — held by many others who, like Alexander, toiled, often in obscurity, on cyber issues — that’s now being offered all over town.

In 1999, only one company was lobbying specifically on data issues, according to Senate records. By the end of the first quarter of 2014, more than 500 companies included data on their lobbying reports. Even more listed cybersecurity and other related privacy and consumer protection issues.

( Also on POLITICO: Congress rewrites jobs training law)

The spending continues to increase despite a gridlocked Congress that has done little to address many of the issues that lobbyists and consultants are pushing on most intently, such as sharing critical security information between the government and private sector.

Other firms have established consulting and public affairs practices that make big money advising corporate clients on the best ways to fortify their virtual and physical vulnerabilities.

“These cyberthreats, taken to an extreme level or scenario, represent potential existential threats to companies and to systems in a way that goes way beyond just inconvenience,” said former Minnesota governor — and onetime GOP presidential candidate — Tim Pawlenty, now the head of the industry advocacy group Financial Services Roundtable.

Longtime players in Washington’s influence industry say they’ve been engaged on cybersecurity issues dating to the buildup to Y2K. There also was high demand after the Sept. 11 attacks in the U.S.

But as technology becomes more ingrained in Americans’ daily lives — consider the information being collected when driving down a city street as cameras capture license plate data, or when swiping a loyalty card for discounts at a drug store — private companies also have recognized in recent years the need to spend even more time and money. And they also are being warned to expect the unexpected. (The Target breach originated through a Pittsburgh-area refrigeration, heating and air conditioning company.)

Digital and data practices have popped up at big, established firms and tiny specialty boutiques alike. Firms like Covington & Burling, Alston & Bird, Arnold & Porter, Venable and Patton Boggs have made big hires in the intellectual property and data security space — satisfying a demand that stretches from the financial services sector to agriculture and education.

“People who are traditional old-school policy wonks are finding they are crossing into cybersecurity because their industry is now on the Internet,” said Mary Bono, a former California Republican congresswoman and subcommittee chairwoman on these issues who now leads a three-person team at FaegreBD Consulting. “Cyber crosses into everything and everybody.”

Many top staffers have been leaving the relevant federal agencies and Capitol Hill committees at the center of privacy, cybersecurity and intellectual property issues for these high-paying jobs at big law firms, trade associations and consultant and lobbying shops.

Perkins Coie last year trumpeted the hiring of Justice Department official Mark Eckenwiler, an expert on electronic surveillance law, as an asset to help clients in the online and application provider and wireless carrier industries “find that delicate balance between protecting user privacy and meeting their obligations under the law.”

Top D.C. law firm Covington & Burling hired Aaron Cooper — the Senate Judiciary Committee’s chief counsel for intellectual property and antitrust law — to build out a data and IP practice last year.

The National Retail Federation hired away Paul Martino from Alston & Bird in July. He was partner and co-chairman of Alston’s privacy and data security practice — and is now working on data security, e-commerce and privacy issues for the retail trade association.

And Greg Hill left his post earlier this year as chief of staff at the House Homeland Security Committee to work for the Chertoff Group, the consulting shop led by President George W. Bush’s second Homeland Security secretary.

“We were cyber before cyber was cool,” boasted Chad Sweet, the Chertoff Group’s CEO and a former Department of Homeland Security chief of staff.

Other high-profile members on Chertoff’s payroll include former CIA Director Michael Hayden and Mark Weatherford, the top cybersecurity official under Janet Napolitano, President Barack Obama’s first Homeland Security secretary. More than half of his nearly 50-person team has experience on cybersecurity issues.

Cybersecurity services have been “one of the most important growth areas of the firm,” Sweet said, citing a more than 30 percent spike in that end of its business during the past year. That includes a consulting gig for the National Retail Federation and work with other commercial customers concerned about recent data breaches like the one at Target.

“It just touched so many people in a very visceral way,” Sweet said. “History will look back at that as the retail sector’s cyber 9/11, if you will.”

Greater corporate demand for in-the-know cybersecurity services also drove Ridge to partner last year with Howard Schmidt, Obama’s former top White House cybersecurity adviser. Their consulting business — serving Fortune 500 companies, government contractors and midsize companies with significant regional footprints and roles inside larger corporate supply chains — banks off the high-level experience both bring from their work for government, law enforcement and the private sector.

“We have global threats and actors who do not recognize national, political or public-private sector boundaries. So the question is, ‘Do you want advisers who have a narrow view of this global challenge or advisers who can provide a greater perspective?’” said Schmidt, who also worked in the George W. Bush White House, as well as for Microsoft and eBay.

Then there’s Alexander, the retired general who spent the last year in the center of the Snowden storm. Since leaving government at the end of March, he’s been pitching his new consulting shop to the financial services industry, hoping that his experience in the military and intelligence community will be an asset for needy clients.

But Alexander’s private-sector push, first reported in May by POLITICO, has also generated complaints. Rep. Alan Grayson (D-Fla.) , a frequent NSA critic, wrote Alexander’s potential clients last month, seeking information about their negotiations and raising questions about whether any deals included an inappropriate sharing of government secrets “for personal gain.”

Grayson, citing a recent Bloomberg news article that said Alexander was demanding hundreds of thousands of dollars a month, cautioned that disclosing classified information for profit is a felony.

“I question how Mr. Alexander can provide any of the services he is offering unless he discloses or misuses classified information, including extremely sensitive sources and methods. Without the classified information that he acquired in his former position, he literally would have nothing to offer you,” Grayson wrote in identical letters to the Consumer Bankers Association, Financial Services Roundtable and the Securities Industry and Financial Markets Association.

An Alexander spokesman called Grayson’s letter “ludicrous” and challenged its premise because it cited a price tag from the Bloomberg story that was “incorrect.”

The former NSA chief also defended his new business in the interview. “I’m not out to gouge anybody. I’m not out to see if I can make the next Google,” Alexander said.

Marquee names aren’t the only ones getting in on the cybersecurity business.

The Electronic Transactions Association, known for more than a decade for staging a high-profile trade show, has beefed up its Washington office by building a government relations team around Scott Talbott, a former aide at the Financial Services Roundtable. It added a political arm – the ETA PAC — last fall, and it’s grown from having annual revenues of about $700,000 in 2009 to becoming a $5.1 million advocacy organization in 2012, the last year tax data was available. As of the first quarter of this year, the association has in-house two registered lobbyists and the law firm Venable working for it.

Trade associations in non-tech industries also have named staffers with tech policy chops to head up their government affairs offices. The International Franchise Association brought on Robert Cresanti as executive vice president handling government relations and public policy. He was a tech policy veteran who served as an undersecretary at the Commerce Department in the Bush administration, at SAP America, the Business Software Alliance, TechAmerica and the Intellectual Property Exchange.

Smaller, specialty lobbying firms like TwinLogic Strategies and the Franklin Square Group also have formed specifically to deal with technology and data issues. Both firms — small operations by the standards of K Street — have experienced phenomenal business growth over the past two years, bucking the overall trend on K Street of flat or declining revenue. TwinLogic, for example, posted nearly 20 percent growth between the start of 2013 and 2014, and it added a third lobbyist: Rachel Wolbers, a top Judiciary Committee staffer.

Dozens of formal and informal coalitions also have sprouted up to tackle the issue of privacy and cybersecurity.

Bill Nelson, president of the Financial Services Information Sharing and Analysis Center, a forum for more than 5,000 firms to collaborate on physical and cybersecurity threats, said his organization has experienced a “membership tsunami” of late as company leaders take note that their risks and responsibilities stretch well beyond the IT department.

“It’s gone all the way up to the C suite,” he said.

The Retail Industry Leaders Association announced in mid-May it was forming a partnership with several large retailers to create the Retail Cyber Intelligence Sharing Center, or R-CISC. Gap, J.C. Penney, Lowe’s, Nike, Safeway, Target, Walgreens Company and others are members of the new group, which is designed to share cyberthreat information among member companies and government agencies like the Department of Homeland Security, the Secret Service and the FBI.

Other older organizations like the National Business Coalition on E-Commerce and Privacy, the Financial Services Roundtable, the Electronic Payments Coalition, the Internet Commerce Coalition and the 21st Century Privacy Coalition also have worked on these issues.

“Everybody is trying to learn as much as possible to prevent another data breach,” said Richard Hunt, CEO of the Consumer Bankers Association.

Corporate victims of some of the most high-profile cyberattacks also are beefing up their Washington ranks with more legal and policy help in the face of heightened scrutiny from regulators and lawmakers.

Reeling from the theft of data affecting up to 70 million customers, Target retained two Venable lobbyists who previously worked for House Republicans, including William Nordwind, a staffer for Energy and Commerce Chairman Fred Upton (R-Mich.). The Minneapolis-based company also has two other outside firms on staff. Social media service Snapchat brought on veteran Democratic lobbyist Heather Podesta after a breach compromised the information of 4.6 million users — a first for a social media company.

Neiman Marcus, which hadn’t reported any outside lobbying since 2000, spent $180,000 during the first quarter of 2014 for lobbying help from eight staffers at Brownstein Hyatt Farber Schreck.

And Michaels in April reported its first outside lobbying spending with Bracewell & Giuliani since 2010.

Even with the industry’s growth, cybersecurity lobbyists, lawyers and consultants face their share of challenges. There’s no organized lobby pushing back against greater data security. Instead, the policy debate centers around differences among industrial sectors over the best way to make changes.

And just as Congress’ dysfunction has halted action on issues as wide-ranging as energy and the budget, it also faces a steep climb and a crowded calendar on cybersecurity bills addressing the private sector’s information sharing. The issue has failed to pack much of a political punch, as consumers stung by the Target breach are saved by industry rules that exempt them from liability.

“You want to legislate this to go away,” Nelson said. “But it’s not going away. It’s getting worse.”

Tal Kopan contributed to this report.