gorodenkoff/Getty
Cybersecurity officials celebrated in November when President Donald Trump launched a new agency within the Department of Homeland Security focused entirely on protecting vulnerabilities in the federal government’s computer systems. But just over a month after the agency was established, nearly half of the staff of the new Cybersecurity and Infrastructure Security Agency (CISA) has been furloughed, which could put the government in a compromised position for guarding against potential cyberattacks. The new CISA reorganized and rebranded an existing division of DHS, making cybersecurity a central concern for the agency.
Approximately 43 percent of CISA staff is currently furloughed, though the remaining staff is presumably on standby in case of a major cyberattack. As of last Thursday, the US Computer Emergency Response Team, which operates under DHS, was continuing to send out cybersecurity warnings to critical infrastructure sectors.
However, without a fully functioning CISA, the risk of a cyber threat does appear to be higher. “If I were a bad actor, this would be a very tempting time to do some mischief,” Suzanne Spaulding, a former DHS official who led the division tasked with cybersecurity, told the Hill.
Danny Toler, the former acting assistant secretary for DHS’s cybersecurity office, told the Hill that CISA is losing “critical momentum” during the government shutdown to get its intended initiatives up and running.
House Homeland Security Committee Chairman Bennie Thompson (D-Miss.) issued a statement last week questioning whether CISA is still monitoring federal networks to guard against cybersecurity attacks on critical infrastructure, state election agencies, and high-risk chemical facilities.
Rep. Robin Kelly (D-Ill.), the chairwoman of the House Oversight and Reform Committee’s IT subcommittee, said last week that the government shutdown is making it more difficult for the federal government to attract and retain talent within the cybersecurity world. According to a report by the Government Accountability Office from last year, DHS had failed to identified many of its vacant cybersecurity needs, let alone fill them.
“How can we ever hope to recruit or maintain IT talent when hardworking government workers are told: ‘sorry, you aren’t getting paid, but you still need to come to work’ or ‘sorry, but no paycheck this week because of politics?’” Kelly said in a statement. “Large private sector companies never say this to their employees and these are our competitors when it comes to IT talent recruitment.”
Furloughed employees could mean that CISA computers go without needed security updates and do not have the day-to-day ability to detect network intrusions as needed. “The first 24 hours between a hack and detection is vital,” Tom Gann, chief of public policy at security research firm McAfee, told Roll Call.
Foreign government hackers could also gain knowledge into which US computer networks are considered “essential” based on which systems are running during the shutdown. “A foreign intelligence organization can deduce from that who matters and who doesn’t,” Gann told Roll Call.
DHS officials could not give comment because they are not working currently due to the shutdown.
