Don’t cut CISA personnel, House panel leaders say, as they plan legislation giving the agency more to do

Reps. Andrew Garbarino and Eric Swalwell said legislative priorities include an expiring information-sharing law and making a threat information-sharing organization permanent.

Leaders of a key House subcommittee criticized the Trump administration’s personnel cuts at the Cybersecurity and Infrastructure Security Agency on Wednesday, with its chairman saying he wants CISA to take on more responsibilities, not less — some of which figure into his legislative priorities.

Rep. Andrew Garbarino, the New York Republican who chairs the House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection, said at an event hosted by Axonius that those priorities include reauthorization of a 2015 cyber threat information sharing law and renewal of a state and local grant program.

“I’m not thrilled with some of the stuff that happened,” Garbarino said, including the firing of probationary employees at CISA. “I think there’s a way to be efficient, I think there’s a way to find savings … in some places when trying to cut the fat, they cut the bone, and we need to fix that.”

He said CISA should take on a broader role within the federal government on cyber, rather than having individual agencies like the Environmental Protection Agency having responsibilities. He wants to carve out a specific role for CISA under the expiring 2015 Cybersecurity Information Sharing Act — the subject of a planned subcommittee hearing next month — and keep CISA involved in administering the expiring $1 billion, four-year state and local grant program, perhaps with a longer 10-year reauthorization.

Despite the Trump administration cuts, Garbarino said he was encouraged by the nomination of Sean Plankey to lead CISA, a sign that the administration was taking the agency “seriously.”

California Rep. Eric Swalwell, the top Democrat on Garbarino’s panel, said at the same event that the personnel cuts at CISA and elsewhere were “schizophrenic” and contrary to the name of the Department of Government Efficiency that’s been pushing federal firings and had them challenged in court.

“One day you’re fired, next week you get an email that you’re not fired, then you go back to work and you’re told, ‘Well, you can’t come into the building, and so you’re on leave, but you have paid leave, and we don’t know if your health care still works,'” he said. “So you have thousands of government employees right now who are not working. They’re on paid leave, they’re all looking for other jobs, and I can’t think of anything less efficient than paying people not to work.”

As one of his priorities, Swalwell would like to advance legislation this year that codifies the CISA-housed Joint Cyber Defense Collaborative into law, plus establish a charter for the JCDC and other modifications. 

Garbarino also plans further oversight of the regulations CISA is writing in response to a 2022 cyber incident reporting law, which he and industry have criticized as overly burdensome. Garbarino said he wasn’t sure yet if the Trump administration would start over on the regulations entirely or make changes in other ways.

The good news for CISA’s future, Garbarino said, is that he and others have worked to educate fellow lawmakers about the agency’s work on disinformation and misinformation. That work, which represents a small part of CISA’s budget, has drawn fire from Republicans, prompting many of them to vote in 2023 in favor an amendment to cut CISA’s funding by 25% — a cut that ultimately didn’t happen. He said he didn’t anticipate a repeat of that vote as a result.

Still, Sen. Rand Paul, R-Ky., is now the chair of the Homeland Security and Governmental Affairs Committee, and he has pledged to fight the agency or even eliminate it. Swalwell said the goal is to make any legislation on CISA so popular that it neutralizes any potential opposition from Paul, but also to win him over — including by convincing people like a Louisville city councilman who testified in favor of the grant program this week to make the case.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure