Four Senate Democrats call on DHS to reinstate Cyber Safety Review Board membership

The lawmakers say the January purge has left the United States blind on the nature of the historic Salt Typhoon telecommunications breach.

Four senators asked Department of Homeland Security Secretary Kristi Noem to reestablish the Cyber Safety Review Board, citing the need to investigate a landmark breach of telecommunications networks by Chinese hackers known as Salt Typhoon.

In a letter Thursday, the senators also said the board has conducted important oversight of other incidents before DHS removed its members in January, such as its report on a breach of Microsoft by other Chinese hackers.

“The CSRB played a vital role in U.S. national security carrying out post-incident reviews and providing information and making recommendations to improve public and private sector cyber security,” wrote Democratic Sens. Mark Warner of Virginia, Richard Blumenthal of Connecticut, Elissa Slotkin of Michigan and Ron Wyden of Oregon. “Therefore, we urge you to swiftly reconstitute the Board with qualified leaders to shape our nation’s cyber response.”

Warner is the top Democrat on the Senate Intelligence panel, and the four members sit on either the Intelligence Committee or the Homeland Security and Governmental Affairs Committee.

DHS purged all members from its advisory boards and committees in January. While the later disbanding of other boards has drawn some concern, the removal of the Cybersecurity and Infrastructure Security Agency-led Cyber Safety Review Board’s members has drawn the most negative reaction from the cybersecurity community. It halted a Salt Typhoon investigation that had only just begun.

While some conservatives have supported the decision, and some experts believed the investigation into Salt Typhoon was commenced too early in the breach, at least one conservative board member suggested to CyberScoop that the board could’ve also probed the government’s failings in the buildup to the attacks.

The four senators also emphasized how the board could’ve aided telecom companies.

“The CSRB’s investigation into the Salt Typhoon compromises of U.S. telecommunication firms, launched in 2024, was effectively terminated on January 20, 2025 and is depriving the public of a fuller accounting of the origin, scope, scale, and severity of these compromises,” they wrote. “It is essential that the U.S. develop a complete and thorough understanding of the factors that contributed to the success of these intrusions — including clear root-cause analyses of each successful penetration — and present key recommendations for the telecommunications sector to better protect itself against similarly complex and large-scale compromises by future threat actors.”

CISA spokespeople say they do not respond publicly to congressional correspondence.

“The January dismissal of CSRB members, and continued uncertainty about the future role of the Board, has undermined cyber defense preparations for public and private entities across the United States. In this age of great innovation, we cannot afford to see our private or public systems compromised by malicious actors,” the senators said. “You have had more than four months to reestablish this Board to conduct this critical work — DHS leadership and CISA must work together to immediately reinstate the Board as a crucial part of America’s cyber defense infrastructure.”

Across party lines and industry, the verdict is the same: CISA is in trouble

The agency lost a third of its people in a year. Now industry and lawmakers on both sides say it's unprepared for a potential crisis.

Cantwell claims telecoms blocked release of Salt Typhoon report 

Sean Plankey nomination to lead CISA appears to be over after Thursday vote

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure