As Arizona prepares for new governor, its CISO focuses on Super Bowl

Like many other Arizona officials, Tim Roemer, the state’s homeland security director and chief information security officer, has been preparing for next month, when Gov. Doug Ducey leaves office after eight years.

In an interview for an upcoming episode of StateScoop’s Priorities podcast, Roemer said he’s been meeting with representatives of Gov.-elect Katie Hobbs’ transition team and discussing what Arizona’s physical and cyber security priorities will look like over the next four years. While Roemer said he’s had a “great relationship” with Hobbs during her stint as secretary of state — including on election-security issues in a state that election deniers have obsessed over — Hobbs’ Jan. 5 inauguration will bring major policy changes as she becomes Arizona’s first Democratic governor after more than a decade of Republican leadership.

While Roemer said he has “so much respect” for Hobbs’ team as they set their priorities, one upcoming event in particular makes a smooth transition of power all the more necessary: the Super Bowl, which will be played next Feb. 12 at State Farm Stadium in Glendale.

“It will be the first major thing that happens in the first month in office for the new administration,” he said. “So we really want to make sure that we set that new executive team up for success.”

Not just the big game

Considered a National Security Special Event — the federal government’s highest tier of public gathering — the Super Bowl is a logistical web of local, state and federal agencies preparing for an influx of hundreds of thousands of people and coordinating it all with the National Football League. In addition to securing physical assets like the stadium, roadways, public transportation and power systems, preparations for the NFL championship include protecting all of the IT assets that go into pulling off the big game, including mobile ticketing apps, streaming media and cashless transactions with stadium vendors.

The Super Bowl also entails much more than just a few hours on a Sunday evening in February.

“We need to make sure we always do a good job of securing all the events in the week of the Super Bowl,” Roemer said. “The NFL Experience” — a weeklong festival the league will stage in Phoenix — “is a big one. But you’ve got team hotels, you’ve got all kinds of media events, you have all kinds of concerts that are going on. And then from a cybersecurity perspective, from a digital perspective, what worries me most is the third parties. So instead of going after the actual stadium, [a hacker is] going to go after a concession vendor.”

Arizona last hosted the Super Bowl in 2015, a few weeks into Ducey’s first term and when Roemer was serving as the new governor’s deputy homeland security director. Roemer was named CISO in August 2019 and in April 2021 was given the additional role of statewide homeland security director.

And as preparations for next February’s championship game have proceeded, Roemer said cyber has become more central to the operation.

“The difference between eight years ago and today is cybersecurity … has a seat at the table for Super Bowl security. And that speaks volumes for what we’re doing.”

‘A well-oiled machine’

Much of Roemer’s role in the Super Bowl is managing grants from the U.S. Department of Homeland Security, a process he said started about a year before the game.

“If there’s any resources a local responder agency needs, let’s say it’s additional cameras, training, you name it, we wanted them to apply at least a year out so we could review it and make sure we’re getting the resources we need spending every grant dollar effectively,” he said.

Then there’s the constant collaboration between the layers of government and the NFL’s security and technology teams. (The league recently hired former Atlanta CIO Gary Brantley as its lead tech officer.) In past years, DHS’s Cybersecurity and Infrastructure Security Agency has committed upward of 60 personnel to Super Bowl duty, with network assessments and vulnerability scans on critical systems beginning nine months before kickoff.

Roemer demurred when asked if he’d been approached by Hobbs’ team about staying with the Arizona Department of Homeland Security after Ducey’s term expires. Right now, he said, he’s focused on the transition and making sure the Super Bowl goes off without a hitch.

“My main priority is making sure the department moves forward in a strong direction, that we have the right people to lead, because the department’s phenomenal,” he said. “I mean, the working people within this department are a well-oiled machine.”