Senate fails to confirm new CISA director before two

The Senate could break for recess without confirming Jen Easterly as CISA director. The agency has lacked a permanent director since November.

The Senate’s failure to confirm a new director for DHS’s top cybersecurity agency before the chamber goes on a two-week recess has raised ire from cybersecurity leaders who say the role is too important to leave unfilled.

President Joe Biden nominated Jen Easterly, a former U.S. National Security Agency official, for CISA director and Chris Inglis as national cyber director in April. The Senate confirmed Inglis last week.

Easterly will be tasked with leading the agency at a critical time for U.S. cybersecurity. The agency is still dealing with the aftermath of a high-profile Russian hack of nine federal agencies. It also faces a growing ransomware crisis, including recent high-profile attacks on fuel provider Colonial Pipeline and meat supplier JBS.

“It’s completely irresponsible for Republicans to block Jen Easterly’s confirmation and delay getting her on the job at a time when we need all hands on deck to protect against the relentless cyber-attacks our country is facing,” Sen. Gary Peters (D-Mich.), chairman of the Senate Homeland Security and Governmental Affairs Committee, wrote in a statement to CyberScoop.

“We’ve seen from recent attacks just how disruptive a major breach can be, and we need qualified, Senate-confirmed leaders in place today to strengthen our defenses against future attacks and protect our national security,” he wrote.

Sen. Rob Portman (R-Ohio), the top Republican on the committee, did not return a request for comment.

The CISA director oversees the agency’s work defending the networks of civilian agencies, managing risks to national critical infrastructure and protecting the election. Easterly will work closely with the White House to help implement new policies to improve federal cybersecurity.

A vote on Easterly’s nomination for CISA director was blocked twice by Sen. Rick Scott (R-Fla.), who says he will continue to hold the nomination until the vice president Harris visits the border. Harris’ office says she will visit the border on Friday.

The Senate adjourns today for a two-week recess until July 9.

“This isn’t about Ms. Easterly. This isn’t about cybersecurity,” Scott said on the floor Wednesday. “I am here today because families in my state of Florida and across our nation deserve accountability.”

Peters wasn’t the only member of Congress to express disappointment of the politicization of Easterly’s confirmation.

“[Sen. Scott’s] obstruction is a gift to our enemies,” Rep. Jim Langevin (D-R.I.) tweeted on Thursday.

Senator Angus King (I-Maine), a co-chair of Congress’ Cyberspace Solarium Commission, also criticized the hold.

“The cyberthreat facing America is too real and too immediate to be using the nomination of one of the most important cyberofficials as a hostage to an unrelated policy matter,” he said in a statement.

The nation’s top cybersecurity agency has gone without a permanent director since former president Donald Trump fired Chris Krebs in November. Trump fired Krebs for concuring with the rest of the intelligence community in assessing that the 2020 election was secure. The position has since been filled in an acting capacity by Brandon Wales.

Krebs on Twitter called the hold “a pawn in a political gambit with grave consequences for our nation’s cybersecurity.”

“One more reason it’s time for a conversation about splitting up [DHS]” he wrote.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure