Federal cyber firings imperil efforts to stop Chinese hacking campaigns, experts tell lawmakers

Firings and staff cuts at the Cybersecurity and Infrastructure Security Agency will endanger efforts to protect critical infrastructure from Chinese government cyberattacks, former federal cyber officials told lawmakers on Wednesday.

During a House Select Committee on the Chinese Communist Party hearing on Chinese cyberattacks, three witnesses were asked about the impact of the Trump administration’s recent decision to fire at least 130 CISA employees and the potential for more staffing cuts in the future.

Rob Joyce, former cybersecurity director at the National Security Agency, told the committee in his opening statement he had “grave concerns that the aggressive threats to cut U.S. government probationary employees will have a devastating impact on cybersecurity and national security.” 

He warned that eliminating probationary employees will “destroy a pipeline of top talent, essential for hunting and eradicating [Chinese government] threats.” 

“Even if they are not eliminated, the pervasive uncertainty and doubt in the current environment are forcing them to seek secure opportunities for their families outside national security,” he said.  

“I implore you, in the strongest possible terms, to consider the catastrophic consequences that this indiscriminate and unfocused pressure will have on the competency and capability of the men and women dedicated to safeguarding our nation. We need this talent to win in competition and conflict.”

Rep. Jill Tokuda (D-HI) asked the other two witnesses — Idaho National Laboratory’s Emma Stewart and former Office of the Director of National Intelligence official Laura Galante — whether they agreed with Joyce on the impact of the firings. 

Both backed up Joyce’s warnings, with Galante saying that CISA’s advisories have played a key role globally in letting other governments, businesses and organizations know what vulnerabilities need to be patched. 

Stewart added that the loss of knowledge from those who have worked for years to develop defenses of networks “will challenge how we coordinate and deploy in future … [and] our abilities to deter these attacks.”

The hearing focused primarily on what the U.S. government needs to do to address multiple ongoing Chinese attack campaigns, referred to by their industry designations of Salt Typhoon, Volt Typhoon and Silk Typhoon. 

Galante noted the firings would be a significant blow to U.S. protection efforts because some subject matter experts have to spend years getting security clearances, and many have cybersecurity knowledge that cannot be easily replaced. 

Later in the hearing, Rep. Shontel Brown (D-OH) raised concerns about the firings that took place not only at CISA but also at the FBI and National Institute of Standards & Technology — both of which play critical roles in cybersecurity efforts. 

Stewart raised practical concerns about how the workforce reductions would complicate lines of communication between critical agencies. 

She noted that the Department of Energy, where she has worked for 20 years, is the sector risk management agency for energy and electricity, serving as the primary point of contact for entities that have to defend against Chinese cyberattacks.

“If we don't have those points of contact, we will be at a fundamental disadvantage. They've built those relationships over a number of years, and they are trusted to talk to these entities and help them on … how to implement the defenses that we actually need,” Stewart said. 

“We need to continue that, but losing those points of contact is a huge problem for us to actually be able to implement those defenses.”