White House asks for additional $110 million in CISA funding to address cyber threats

The money would allow the Cybersecurity and Infrastructure Security Agency to improve its defensive tools and hire more experts, officials said.

The White House on Friday asked Congress for $110 million in additional funding in 2022 to help the Department of Homeland Security shore up federal and state defenses in the wake of high-profile hacking operations. 

The money would allow DHS’s Cybersecurity and Infrastructure Security Agency to improve its defensive tools, hire more experts and “obtain support services to protect and defend federal information technology systems,” Shalanda Young, the acting director of the Office of Management and Budget, wrote in an April 9 letter to congressional appropriators. It would add to a recent $650 million funding boost for CISA that was part of the coronavirus relief package cleared by Congress.

The White House’s discretionary funding request for CISA in fiscal 2022 totals $2.1 billion, or $110 million more than Congress allotted the agency the previous fiscal year. Discretionary budgets are those that Congress can alter with appropriations bills, in contrast to the “mandatary” funding that is built into law.

The funding request also includes $20 million for a new “cyber response and recovery fund” at DHS meant to help state and local government recover from things like ransomware attacks. The request also calls for more federal investment in cybersecurity research, with the Biden administration proposing an additional $128 million, compared to the fiscal year for 2021, going toward the National Institute of Standards and Technology.

The Biden administration’s appeal for more cybersecurity funding comes as U.S. officials continue to investigate suspected Russian and Chinese cyber-espionage operations. Alleged Russian hackers exploited software from the federal contractor SolarWinds and other vendors to breach at least nine federal agencies, while suspected Chinese spies used a vulnerability in Microsoft software to steal email inboxes at unnamed U.S. organizations.

Both cases have exposed weaknesses in U.S. public and private defenses, sending lawmakers and White House officials searching for answers. While the U.S. government mulls a response to the incidents, Department of Homeland Security Secretary Alejandro Mayorkas has pledged that the government will do more to improve its defenses.

“Our government got hacked last year and we didn’t know about it for months,” Mayorkas said last week, referring to the suspected Russian effort.

In her letter, Young said that hacking campaign underscored “the urgent need to modernize federal technology, with particular emphasis on mission essential systems and citizen-facing digital services.”

To that end, the discretionary request includes $500 million for the federal Technology Modernization Fund to try to get rid of outdated software used by the government.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure