US ‘slipping’ on cybersecurity, annual Cyberspace Solarium Commission report concludes

The annual implementation report recommends reversing Trump administration budget cuts, empowering the national cyber director and other steps.

The Trump administration should reverse cyber personnel and budget cuts, strengthen the Office of the National Cyber Director and expand federal workforce initiatives, the successor organization to the Cyberspace Solarium Commission recommended in a report published Wednesday.

The annual implementation report from CSC 2.0 is the first of five iterations to actually determine that the nation has gone backward on enacting the agenda of the landmark bipartisan commission, whose suggestions led to the creation of major new federal organizations and policies, including the national cyber director’s office.

In grading the degree to which its 2020 report had been enacted — whether they’re “implemented,” “nearing implementation,” “on track,” “progress limited” or facing “significant barriers” — the percentages dropped in every category, after years of rising or staying steady.

“Our nation’s ability to protect itself and its allies from cyber threats is stalling and, in several areas, slipping,” states the report, in a passage written by former chairman Sen. Angus King, I-Maine, and executive director Mark Montgomery. “This year’s assessment makes clear that technology is evolving faster than federal efforts to secure it. Meanwhile, cuts to cyber diplomacy and science programs and the absence of stable leadership at key agencies like the Cybersecurity and Infrastructure Security Agency (CISA), the State Department, and the Department of Commerce have further eroded momentum.”

The Trump administration’s federal budget cuts haven’t spared cyber agencies and missions. President Donald Trump has restructured State Department cyber work and eliminated a public-private panel devoted to critical infrastructure information sharing. Meanwhile, his nominee to lead CISA is still awaiting Senate confirmation. 

The first recommendation in Wednesday’s report is to enhance the power of the national cyber director, who “still lacks the positional authority and interagency relationships needed to enforce decisions across the government,” the report observes. For instance, it can review agency budget submissions but can’t align cyber investments across departments.

Two of the report’s recommendations suggest restoring the sliced CISA budget and workforce and restoring the State Department Bureau of Cyberspace and Diplomacy. Another recommends undoing the elimination of the public-private panel, the Critical Infrastructure Partnership Advisory Council.

The fifth recommendation is to expand the talent pool of the cyber workforce and improve retention. On that count, the report notes, Trump administration rollbacks of diversity, equity and inclusion initiatives have shrunken the talent pipeline.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure