Swalwell seeks answers from CISA on workforce cuts

Learn more.

Rep. Eric Swalwell, D-Calif., sent a letter Tuesday to acting CISA Director Madhu Gottumukkala raising concerns about staffing levels and the direction of the nation’s primary cybersecurity agency, writing that the “Trump Administration has undertaken multiple efforts to decimate CISA’s workforce, undermining our nation’s cybersecurity.”

Swalwell, the ranking member on the House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection, called out the agency for its reported shift of cybersecurity personnel to the Department of Homeland Security’s deportation efforts, on top of the approximately 760 people that have been let go from the agency since January. 

“Amid reports that the Department of Homeland Security is now forcibly transferring CISA’s cybersecurity employees to other DHS components, it has become apparent that the Department’s exclusive focus on its mass deportation campaign is coming at the expense of our national security,” Swalwell writes. “As further evidence of the Administration’s failure to prioritize cybersecurity, CISA is now engaging in Reductions in Force (RIFs) that threaten CISA’s capacity to prevent and respond to cybersecurity threats. I demand you immediately cease all efforts to cut CISA’s workforce, reinstate employees who were transferred or dismissed, and provide details on the impacts of the agency’s workforce reductions.“

The letter is not the first time Swalwell has asked for information about CISA’s workforce. In April, he asked the agency to brief the subcommittee on its workforce plans. He wrote in Tuesday’s letter he had not heard back from CISA. 

Further in the letter, Swalwell says shifting CISA personnel to deportation efforts takes away from the agency’s core mission at a time of “unprecedented cybersecurity threats,” pointing to the emergency directive issued last month about an ongoing and widespread attack spree affecting Cisco firewalls. He also questions CISA’s ability to leverage third-party expertise, given the agency’s September termination of its agreement with the Multi-State Information Sharing and Analysis Center — a partnership previously underpinned by $27 million in federal funding for fiscal year 2025. 

“In order to combat these threats, CISA needs to have sufficient personnel to carry out its mission, particularly at a time when canceled contracts and cooperative agreements have left CISA without critical third-party support,” Swalwell writes. 

You can read the full letter below. 

A CISA spokesperson sent CyberScoop the following statement:

“During the Biden Administration, Rep. Swalwell had no issue with CISA performing duties outside of its statutory authority – including censorship, branding, and electioneering. Under the leadership of President Trump and Secretary Noem, CISA focused squarely on executing its statutory mission: serving as the national coordinator for securing and protecting U.S. critical infrastructure. CISA is delivering timely, actionable cyber threat intelligence, supporting federal, state, and local partners, and defending against both nation-state and criminal cyber threats.”

Update: October 18, 2025, 4:00 pm: This article has been updated with comment from CISA.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure