State Department proposes new $20.8 million cybersecurity bureau

The new bureau, with a projected staff of 80 and budget of $20.8 million, would be led by a Senate-confirmed coordinator and “ambassador-at-large."

The State Department has sent to Congress a long-awaited plan to reestablish a cybersecurity-focused bureau it says is key to supporting U.S. diplomatic efforts in cyberspace.

The State Department’s new plan, obtained by CyberScoop, would create the Bureau of Cyberspace Security and Emerging Technologies (CSET) to “lead U.S. government diplomatic efforts to secure cyberspace and its technologies, reduce the likelihood of cyber conflict, and prevail in strategic cyber competition.”

The new bureau, with a proposed staff of 80 and projected budget of $20.8 million, would be led by a Senate-confirmed coordinator and “ambassador-at-large” with the equivalent status of an assistant secretary of State, who would report to the Undersecretary of State for Arms Control and International Security. The idea comes nearly two years after then-Secretary of State Rex Tillerson announced he would abolish the department’s cybersecurity coordinator position and put its support staff under the department’s economic bureau.

CSET would “unify the policy functions and align national security responsibilities related to cybersecurity and emerging technologies with the department’s international security efforts,” and “promote the department’s long-term technical capacity in these areas,” states the document, which the State Department submitted this week to the House Foreign Affairs Committee.

In February 2018, after disbanding the cybersecurity coordinator position, Tillerson proposed a Bureau for Cyberspace and the Digital Economy headed by a Senate-confirmed assistant secretary, but that plan was never implemented.

Some lawmakers and former U.S. officials strongly criticized Tillerson’s handling of the department’s cyber portfolio, saying the U.S. signaled to allies and adversaries a reluctance to shape global cyber norms.

After Tillerson effectively downgraded the coordinator’s office, Deputy Assistant Secretary Robert Strayer served as State’s top cyber diplomat, continuing State’s work on issues such as international cyber norms and building the cybersecurity capacity of allies. Strayer has rejected any notion of U.S. disengagement on international cybersecurity issues. Recently, amid steady reports of state-sponsored hacking, the State Department has to looked to restart talks on global cybersecurity norms at the United Nations.

The new State Department plan also calls for the existing Bureau of Economic and Business Affairs to increase its focus on the digital economy, global internet governance, and privacy issues. Some former officials, like Christopher Painter, who was State’s cybersecurity coordinator when Tillerson axed the position, said issues like internet governance should be included in the new bureau’s mandate rather than be kept separate.

Painter said the new plan for CSET was a “missed opportunity” because it did not consolidate cybersecurity-related issues under the department’s portfolio.

“It’s great that State is finally seeking to re-elevate vital cyber issues after nearly two years of limbo,” Painter told CyberScoop. “Unfortunately, rather than take a coordinated approach to these cross-cutting issues, the department has adopted a balkanized one that will only lead to turf battles within the department and confusion outside and international partners.”

A State Department representative confirmed to CyberScoop a plan had been submitted to Congress.

The State Department’s new cybersecurity bureau has been in the works since at least last summer, when Secretary of State Mike Pompeo signed a memo that would have established it, Foreign Policy reported in January.

Politico was first to report on the congressional notification.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure