Congress set to establish White House national cyber director, enact other Solarium Commission recommendations

Congress is also set to hand CISA administrative subpoena powers and direct the executive branch to conduct "continuity of the economy" planning.

Congress is on the verge of creating a Senate-confirmed national cyber director within the White House who would advise the president on cybersecurity and coordinate the federal government’s related work.

And supporters say it would improve on a White House czar position that President Donald Trump controversially eliminated: In addition to Senate confirmation, it would be housed outside of, rather than under, the National Security Council.

Multiple sources familiar with negotiations on an annual must-pass defense policy bill say that the final agreement will include the national cyber director position. And it will largely reflect a proposal by the Cyberspace Solarium Commission, which earlier this year put together a comprehensive report that made sweeping recommendations. The Trump White House had opposed the creation of the position.

It’s not the only major recommendation from the commission that was included in the legislation, either, according to those sources. Another provision would grant the Department of Homeland Security the power to issue administrative subpoenas to internet service providers to track down critical infrastructure owners when the department’s Cybersecurity and Infrastructure Security Agency (CISA) discovers a vulnerability but can’t get in touch.

The bill would direct the executive branch to conduct “continuity of the economy” planning to ensure that goods and services can still flow in the event of a devastating cyberattack. It would establish a joint cyber planning office at CISA. And it would order a force structure assessment of the Cyber Mission Force at Cyber Command, whose requirements were last defined in 2013.

The defense legislation could be released as soon as Thursday, and while Trump has threatened to veto it over unrelated matters, Congress will almost certainly have the votes to override if he follows through on it.

‘An empowered senior adviser’

President Barack Obama had established a White House cybersecurity coordinator within the National Security Council, but Trump got rid of it midway through his term in 2018 amid bipartisan protest on Capitol Hill.

“Given the complex nature of cybersecurity and its importance to our national security, economic security, and foreign policy, the president needs an empowered senior adviser focused on this issue,” Michael Daniel, who held the coordinator position under Obama, wrote in in a CyberScoop op-ed in favor of the proposal for a more powerful national cyber director position.

The newly proposed position would be on a short list of White House officials who are Senate-confirmed. Placing the role outside the National Security Council would elevate its visibility.

“A Senate confirmed leader that demonstrates the weight both Congress and the Executive branch put on the issue is necessary to meet the moment,” Camille Stewart, a former DHS official, wrote in another CyberScoop op-ed.

POLITICO first reported that the national cyber director position would be included in the defense bill.

Trump turns to private sector in offensive hacking operations memo

One expert called it a “pretty big shift in U.S. cyber policy,” and there have been reservations in the past about opening the door to private sector…

National cyber director lays out White House plans to secure AI without writing new rules

Trump blames Minnesota for cyberattacks on water sector, drawing pushback from cyber world

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure