COLORADO SPRINGS FOCUSED ON BEING HUB OF INDUSTRY

ABOUT THE SERIES

The goal of this series is to explain what cybersecurity is and why Colorado Springs is becoming a hub for the industry. What we found is that cybersecurity evolving and is not easily defined, but it touches nearly every aspect of life in a digital world, and industry is trying to keep pace with hackers who adapt as rapidly as technology changes. What that means to Colorado Springs remains to be seen, but one thing is certain: The city is poised to become a key player in a global industry.

A meeting is held in the conference room at root9B on Wednesday, March 30, 2016. Photo by Stacie Scott, The Gazette.

COLORADO SPRINGS FOCUSED ON BEING HUB OF INDUSTRY

  • Tom Roeder and Wayne Heilman
  • Comments

Colorado Springs’ economic future could depend on how it fits within an emerging industry to tackle hackers.

Millions, even billions, of dollars could be in the offing for the cities that become cybersecurity central in the United States. All that money is tied to changes in how the military and industry address cybersecurity — the protection of computers and online networks from crooks, enemy armies and disgruntled individuals who can cause mayhem on the Internet.

The toughest questions to answer, though, are how to define the new industry and how big it might get. Can Colorado Springs become the national headquarters for the cybersecurity industry?

“It’s so big and moving so fast,” said Kathy Boe, CEO of Boecore, a Colorado Springs defense contractor that’s rapidly pushing into cyberspace.

Ron Sega, the Pentagon’s former chief technology officer, agreed on the scope.

“It’s a system of systems,” Sega said during a recent Colorado Springs cybersecurity conference.

The Colorado Springs Regional Business Alliance says the cybersecurity sector includes more than 80 businesses, all five local military installations, five nonprofits and several college programs that train workers for the industry.

Andy Merritt, the alliance’s chief defense industry officer, estimates the industry locally employs between 1,000 and 10,000 people earning an average annual salary of $116,000. The alliance has been unable to come up with a better estimate of the industry’s workforce because the amount of an employee’s cybersecurity responsibilities varies, Merritt said.

Cybersecurity - Infographic

“We aren’t cyber mountain yet,” said Al Wenstrand, the alliance’s chief economic development officer. “The cyber capital of the nation is still in the Washington, D.C., area, including parts of Maryland and Virginia. The second-largest location is in California, but it is not concentrated in one community. We compete with Huntsville, Ala.; San Antonio, Texas; Salt Lake City and the Research Triangle area in North Carolina, since all five areas are about the same size in terms of the number of employees and customers that are operating in each community.”

“Awareness of the cyber threat has never been higher,”
- Eric Hipkins, root9B

The military remains one of the biggest players. Major military computer hubs include Cheyenne Mountain along with Peterson and Schriever Air Force bases.

Peterson’s Air Force Space Command leads that service’s cyberwarfare efforts and controls the nation’s military satellites — which form the network where much of the military’s computer data flows. Peterson’s U.S. Northern Command has a growing cyberwarfare arm to help troops there protect the U.S. from attacks.

The Air Force Academy is building the Air Force Cyber Innovation Center on its campus, and the first cadets with computer security degrees will graduate in May. The bowels of Cheyenne Mountain contain hard drives and servers by the dozen as the military uses a facility designed to protect people from nuclear weapons to house data.

Beyond the military piece, the industry is so new — the term cybersecurity has been in use for only a few years — that the big players don’t even agree on what the industry includes.

Aerospace companies are a good example of the difficulty in quantifying the scope and size of the local cybersecurity industry, said Frank Backes, CEO of Braxton Science & Technology Group.

“Braxton does space operations as well as command-and-control operations. None can be done without a network or a cybersecurity element,” Backes said. “Where does software development end and cybersecurity start? Everybody doing command-and-control, space operations and data center support and protection are involved in cybersecurity. They have to be. That is why it is so difficult to break out cybersecurity as a separate market.”

Erik Mitisek, CEO of the Colorado Technology Association in Denver, said he believes the Springs has the nation’s highest concentration of cybersecurity professionals, as a percentage of the population. But numbers to back up that claim are difficult to assemble.

“You can easily count the number of coffee shops in a city, but in the security industry, you have a lot of people who have special security clearances and they don’t talk about the projects on which they are working. Because of the culture of the industry, it is hard to get your arms around the market in this area,” Mitisek said.

Why Colorado Springs?

The reason Colorado Springs has emerged as a cybersecurity capital is deeply rooted in the city’s past.

Thanks to the Cold War, Colorado Springs was the world’s first city to log in to what later became the World Wide Web — with a project that had its roots in the Eisenhower administration. Those first online computers were underground at Cheyenne Mountain Air Force Station as part of a system called “packet switching,” which allowed the long-distance transport of data to connect Washington with the mountain hub, where airmen worked to detect Russian missile launches.

It went online in 1968.

COLORADO SPRINGS FOCUSED ON BEING HUB OF INDUSTRY (Bottom Half)

“It was one of those peripheral things the operators didn’t pay much attention to,” said retired Air Force Maj. Gen. Wes Clark, who worked in the mountain during the classified dawn of the Internet age.

In the decades that followed, computing power in the Pikes Peak region grew exponentially and the military technology that built the Internet came into widespread public use.

The dawn of the computer age and the networks that later became the Internet brought an army of defense contractors to build, operate and upgrade computer and communications systems first for the North American Aerospace Defense Command and later for Air Force Space Command and Northern Command.

That work brought software engineers, network engineers, computer scientists and others to the Springs to work for giants that would become Lockheed Martin Corp., Boeing Co., Northrop Grumman Corp., Raytheon Co., Harris Corp. and dozens of subcontractors long before the term cybersecurity came into common usage. While those employees might not have spent their workdays defending computer networks against hackers, spies and other intruders, keeping their employer’s computer systems and networks secure was a key part of their job.

The computer security industry grew from the expansion of the technology industry in the 1980s and 1990s with the arrival of major software or technical support operations. Network security also played a huge role in the data centers — which store critical customer and company information and complete online transactions — that opened in recent years.

It took nearly 30 years for the military to recognize that the Internet could become a battlefield. In 1997, retired Air Force Gen. Tom Marsh wrote a paper that predicted a computerized version of Pearl Harbor.

In January, Gov. John Hickenlooper proposed building the National Cyber Intelligence Center as part of a strategy to make the city a national hub for cybersecurity. The center is scheduled to begin operations this year and would help businesses, nonprofits and government agencies nationwide combat and recover from cyberattacks; help business executives, public officials and bureaucrats learn more about cybersecurity; and conduct research into cybersecurity threats.

Room to grow

While all parts of the cybersecurity industry are growing, the commercial market for such services holds the greatest potential for growth in Colorado Springs by attracting outgoing military personnel who have cybersecurity expertise, Wenstrand said. That has made the Springs fertile recruiting ground for cyber talent, say cybersecurity companies like Imprimis and root9B.

“Awareness of the cyber threat has never been higher,” root9B CEO Eric Hipkins said. “People are beginning to realize the amount of chaos that can be caused with a true cyber event. We have clients across the Fortune 500 and the retail, financial services, industrial control and Department of Defense industries.”

The availability of workers likely will be what limits the cybersecurity industry’s growth, since job openings outnumber job candidates worldwide by hundreds of thousands or even millions, Merritt said.

“We have about 2,000 unfilled information technology openings, according to monthly statistics (by the Colorado Department of Labor and Employment). That is fewer than our competitors,” Wenstrand said.

Entry-level workers with a relevant college degree can earn annual salaries between $55,000 and $65,000, and workers with five to 10 years of experience in the industry can earn between $80,000 and $100,000 a year. Add a security clearance to that level of education and experience and salaries in the industry can easily approach $200,000.

“Our workforce will drive our success with this industry as we compete with other communities for corporate expansions,” Wenstrand said. “The opportunity is there for this industry to help replace the (thousands) of manufacturing jobs we have lost in the past 15 years. This industry pays above-average wages, and the employers who are looking at Colorado Springs are aggressively expanding.”

While the alliance is recruiting cybersecurity companies of all sizes, Wenstrand is putting his focus on small and mid-sized companies that will be based in Colorado Springs and be less likely to shut down their headquarters than a branch office when the industry inevitably faces cutbacks.

“Companies based here will be general revenue and profits from all over the world,” from cybersecurity operations, said Backes, the Braxton CEO who authored a paper in November for Mayor John Suthers on the industry and its potential for growth in the Springs. “Revenue comes from where the work is done. But if headquarters are here, profits stay in the community and are reinvested. Braxton is a good example. We have offices all over the country, but the profits come back to Colorado Springs, so the economic impact is greater.”

Backes believes the local economic impact of the cybersecurity industry could exceed the economic boom of the 1990s launched by the arrival of a manufacturing plant for Apple Inc. and a software development operation for MCI Telecommunications and accelerated by the opening of a semiconductor plant by Intel Corp.

“The market is as big or bigger than the markets were at that time for those companies and none of them were headquartered here, so when times got tough they either left Colorado Springs or significantly reduced the size of their operation. We have the opportunity to not just have companies headquartered here, but for the industry to be headquartered here,” Backes said. “We need to talk about a brand for Colorado Springs like Silicon Mountain was in the 80s and 90s. We need to make sure that the headquarters of the industry is here.”