Virginia economic development officials have kept their lips tight about the incentive package Virginia is extending to Amazon.com, Inc., to induce the e-commerce giant to locate its second headquarters in Northern Virginia. My concern has been that the Commonwealth might attempt to outbid other states in dangling obscene tax breaks and subsidies to attract the project, which could  generate $5 billion in investment and hire 50,000 employees. But as it turns out, it looks like Virginia might be taking the right approach.

Del. Chris Jones, R-Suffolk, chairman of the House Appropriations Committee, made some reassuring statements to Michael Martz in the Richmond Times-Dispatch reporter’s article today about the CyberX initiative.

[Jones] and other state officials would not comment on the contents of a state incentive package to land the coveted headquarters, but Jones confirmed the state would rely heavily on indirect incentives, such as investments in higher education and transportation improvements that Amazon has made priorities in the high-profile search it began in September.

Prominent among those investments, apparently, is CyberX, a $50 million initiative cooked up by Jones and Virginia Tech President Timothy Sands during the General Assembly’s extended budget deliberations earlier this year. Here’s the thing: CyberX, which aims to address the unfilled 30,000 positions in cyber-security and related jobs in Northern Virginia, represents a workforce-related investment that Virginia needs to make whether Amazon decides to locate in Virginia or not. The severe cyber-security skills shortage is throttling on growth in Virginia’s most economically dynamic region. If we could solve this issue, we’d get plenty of economic growth with or without Amazon.com.

As described in the budget amendment, modest sums will be allocated to the initiative in the upcoming fiscal year, with a bonanza scheduled for FY 2020. The initiative will consist of a “primary hub” located in Northern Virginia with a network of “spokes” linking to other universities around Virginia for the purpose of building “an ecosystem of cyber-related research, education, and engagement that positions the Commonwealth as a world leader of cybersecurity.” Virginia Tech will serve as the “anchoring institution” and coordinator of the Hub.

Funding includes:

• $15 million to the Virginia Research Investment Fund (VRIF), which will do two things: (1) certify public institutions of higher education to participate as “spokes,” and (2) provide matching funds for faculty recruitment.
• $10 million for Virginia Tech to lease space and establish the Northern Virginia Hub.
• $15 million for Virginia Tech to provide research faculty, entrepreneurship programs, student internships and educational programming at the Hub.
• $3 million for a cyber-physical systems security lab at the Hub.
• $3 million to support cyber-physical systems security labs at spoke sites across the Commonwealth.
• $3 million to establish a machine learning lab at the Hub.
• $1 million for classroom and distributed learning infrastructure improvements at the Hub.

Increasing the capacity of Virginia’s higher-ed system to train cyber-security employees may be a necessary condition for addressing the yawning IT skills gap, but it may not be a sufficient condition. Several questions arise.

First, how much of this money is going to workforce training and how much going to academic R&D? Martz’s article focuses on the fact that Virginia Tech and George Mason University are getting $250,000 each to hire a top cyber-security researcher. How does more research impact the skill shortage?

Second, is there a sufficient supply of high school graduates with the academic preparation and aptitude to enter these programs — or will Virginia Tech have to recruit aggressively from outside the state to find students?

Third, given the high cost of housing and the horrendous, soul-draining traffic congestion in Northern Virginia, will graduates of these programs even want to seek employment in the region — or will Virginia spend money to develop the human capital that other metros end up hiring?

Fourth, Jones’ comment to Martz implies that the General Assembly might be willing to make additional transportation “investments” in Northern Virginia, which are sorely needed. But what magnitude of such investments will be required to diminish NoVa traffic congestion to a degree that anyone can notice?

Despite those questions, CyberX strikes me as sound strategic thinking. The initiative serves an indisputable need, and the funds invested don’t put money in the pockets of a company with the world’s largest market capitalization. The investment builds Virginia’s capacity for cyber-security innovation.