Steve Gibson (87:31)
So I'm sure that all of our US domestic listeners are aware that I keep politics out of this podcast that doesn't require much work on my part for the simple reason that politics for its own sake would be off topic for us. You know, no one comes here to listen to my opinion about the state of the US Political scene. This is a podcast about security and privacy and the interesting technologies that surround those topics. That said, earlier this year, our newly elected US President, Donald John Trump, let loose the world's richest man, Elon Musk, upon the federal government with the charter to find and eliminate as much waste, fraud and abuse as he could find anywhere and everywhere he believed it existed. This was a process unlike anything this country has ever seen before. Generally and historically, our political leaders appear to be so stuck that nothing is ever really able to change. There's also a well understood tendency for bureaucracies to grow without limit, as individuals at the tops of departments always ask for larger appropriations because with a larger budget comes increased political power and sway. So it might be that within this chronically calcified environment, Trump's deliberate strategy of turning a bull loose in a in the China shop was the only way to affect change. And it's undeniable that many things were changed almost overnight. Lots of people are happy that happened, just as plenty of others believe it was insane and reckless. I'm a citizen spectator and all I can really say is it's been quite a show. So far, and that I'll be interested to see what all comes of this. The one area of the functioning of our government that is of direct bearing to this podcast is the effects that these events have had on the US's preparedness, cybersecurity, defense, and posture. As might be expected, anytime staffing is significantly cut back, there's at least a disruption. At the very least, while the survivors and their management wait to see what's coming next and then begin to rejigger their new resources to figure out how to hopefully get the most important work done with the resources that they now have. It's for this reason that I decided to share last Wednesday's reporting from an organization we've quoted in the past cybersecurity dive about the effects so far and at this stage of that in that inevitable rejiggering effort, as might be expected, things Things seem a bit hectic on the ground at the moment. Their report's headline was Suspended Animation. US Government Upheaval has Frayed partnerships with Critical infrastructure and their subhead reads. Recent federal cuts, reorganization and other disruptions have alarmed industry leaders who say the government is a less reliable partner even as cyber threats increase. So here's what their interviews with many people involved on the ground and their reporting found, they wrote. The Trump administration's chaotic overhaul of the federal government has seriously weakened the public private partnerships that protect U.S. critical infrastructure from cyber attacks and physical disasters. Massive workforce cuts, widespread mission uncertainty, and a persistent leadership void have interrupted federal agencies efforts to collaborate with the businesses and local utilities that run and protect healthcare facilities, water treatment plants, energy companies and telecommunications networks, according to interviews with 14 representatives of those four critical infrastructure sectors, four former senior government cybersecurity officials, and multiple infrastructure security experts. Government leaders have canceled meetings with infrastructure operators, forced out their long time points of contact, stopped attending key industry events, and scrapped a coordination program that made companies feel comfortable holding sensitive talks about cyber attacks and other threats with federal agencies. Quote, the partnership is in suspended animation, said a health care industry representative who, like most others interviewed for this story, requested anonymity to discuss sensitive matters. Quote, the partnership at the end of last year had reached a level of maturity that was promising, and now that's all been pulled back. The result, experts and industry officials say, is reduced trust between the public and private sectors, a diminished understanding on each side of the other side's needs and concerns, a declining capacity to plan for future attacks, and a growing national vulnerability to debilitating hacking campaigns, all at a moment when the Trump administration's intervention in Israel's war with Iran has raised fears of retaliatory Iranian cyber attacks on US Critical infrastructure. Quote, we're seeing something unprecedented in cybersecurity a government deliberately divided to di. I'm sorry, a government deliberately deciding to divest in its capabilities, said Michael Daniel, the president of the Cyber Threat alliance who served as President Barack Obama's cybersecurity advisor. I don't see how this is retrenched, how this retrenchment can do anything other than make us worse off, unquote. Nation state hackers and cybercriminals have repeatedly breached and sometimes disrupted US Critical infrastructure in recent years, including in key sectors of healthcare, energy, water and telecommunications. These intrusions have heightened fears about companies readiness to withstand more serious attacks, as well as underscoring the urgency of government efforts to assist them. But under the Trump administration, agencies engagements with their critical infrastructure partners have varied widely, with some conversations continuing while others have almost entirely stopped. The Department of Homeland Security's elimination of the Critical Infrastructure Partnership Advisory Council CIPAC framework in March has been the most seismic disruption. CIPAC allowed government and industry representatives to discuss sensitive cybersecurity information, including about companies security vulnerabilities, without meeting standard transparency requirements that would expose that information to the public. Without cipac, critical infrastructure operators have dramatically reduced their sensitive cyber conversations with the government, according to a wide range of industry representatives, all of whom describe this the dissolution of CIPAC as disastrous. The absence of CIPAC creates this big fear and poses a huge risk for companies that want to share cyber threat information with the government, said an industry representative in the in the energy sector, there's a doubt of are we sharing too much? CIPAC's demise forced the telecommunications sector to suspend or modify several projects it was working on with the government, causing a significant impact, according to a communications sector representative. The sector had to take on more responsibility for an Internet routing security initiative previously led by the White House, pause research on artificial intelligence powered threat intelligence and freeze, a collaboration with the National Security Agency on nation state attacks. The interruptions come as telecom companies reel from China's salt typhoon campaign of extensive and alarming intrusions into their networks. Federal agencies are working on a replacement for CIPAC that would broaden the range of private sector participants in meetings, according to multiple industry figures who said it was urgent that the government launch that replacement as soon as possible. The oil and natural gas industry is currently refusing to share the products of its cyber working groups with the government. Quote, until we are assured that we have those CIPAC protections according to an energy industry representative. In the meantime, the industry canceled its spring meeting with the government because companies didn't know what they'd be able to safely share. Sector leaders have scheduled another meeting in anticipation of CIPAC replacement, but if that fails to materialize, the industry doesn't expect cyber conversations with the government at that meeting or to be very productive. DHS declined an interview request for this story, and the department did not respond to a question about the CIPAC replacement. The Trump administration's changes have also undermined some cyber information sharing, the cornerstone of the public private partnership keeping critical infrastructure safe from hackers. Because the private sector operates most critical infrastructure, it knows more than the government does about how that infrastructure works, what cyber attacks are occurring against it, and what the impact of a successful intrusion would be, according to John Riggi, the national advisor for cybersecurity and risk at the American Hospital association and a former FBI Cyber Partnership official. The industry in turn relies on the government to supply both unique foreign intelligence and cyber threat information for which it would otherwise have to pay private firms. Small infrastructure operators with threadbare security budgets are especially dependent on this free information from the government. But information sharing is taking a major hit, according to Errol Weiss, chief security officer at the Health isac, the industry's information sharing and analysis center. The pace of alerts from the Cybersecurity and Infrastructure Security Agency, CISA and the FBI definitely looks like it's slowing down a bit, weiss said. Riggy described a delay in receiving threat intelligence from CISA because of the leadership change, though he said sharing with the FBI continues to be very robust. Threat briefings are still occurring, industry figures said, but their frequency has become uneven as relationships with agencies have grown strained and federal workers have retired or been laid off, quote, they definitely tapered off, said industry water industry representative. The EPA press secretary, Bridget Hirsch said the agency has continued to provide briefings with the same cadence as in the past. Trump's federal travel restrictions have also made it harder for government employees to attend industry events and tour infrastructure facilities, quote, it's difficult to get them to meetings, weiss said. It took a long time for government officials to get permission to attend the industry's annual tabletop exercise on Thursday, which will game out how the country would respond to a major cyber attack on health care facilities. At the same time, Trump has continued a project that former President Joe Biden launched last year to speed up the pace of briefings. The Critical Infrastructure Intelligence Initiative, run by CISA and the intelligence community, provides provides cleared industry officials with a classified readout on the threat landscape on the first Wednesday of every month, A second water industry representative called it an improvement over the briefings for smaller groups of industry leaders at biannual sector leadership meetings. No agency has seen more change under Trump than cisa, according to experts and industry figures. Congress created CISA in 2018 under the first Trump administration to serve as the hub of of the government's cybersecurity partnerships with US infrastructure operators. But CISA's efforts to counter misinformation during the 2020 election transformed it into a conservative boogeyman, and the second Trump administration quickly began targeting the agency, freezing its election security work, pushing out roughly one third of its 1300 person workforce, ending threat hunting contracts and proposing even deeper cuts. Now, infrastructure operators say they barely recognize the fledgling but ambitious agency they had gotten to know over the past six years. Quote with cisa, there is no partnership, it's gone, said a second energy industry representative, quote we can't even seem to get meetings with the necessary folks there. Unquote sisa's recent cuts, quote, have severely affected the agency's ability to engage meaningfully with industry stakeholders, said Len Slovata, general manager of the public sector at the operational technology security firm Claire Clarity. CISA spokesperson Marcy McCarthy said the agency remains fully committed to its core mission of securing the nation's critical infrastructure and enhancing cybersecurity resilience, adding that private public collaboration is defined by outcomes such as reduced risk, improved response and strengthened trust, not by the number of meetings, unquote But CISA employees say they're deeply frustrated with the changes and reductions at their agency. We're a bit of we're at a bit of a standstill, said one CISA staffer, who requested anonymity to speak freely. People are adjusting to having lost a good chunk of their workforce. We're trying to find the new normal given the departures and changing mission parameters, unquote the Joint Cyber Defense Collaborative, which the agency launched in 2021 to make its private partnership the private public partnerships less conversational and more operational, has seemingly fallen dormant. Quote I've not heard a peep from JCDC the last few months, unquote, said the first energy industry representative. The industry spent two years working with JCDC on a multi part effort to address state backed cyber attacks on mainstream gas pipelines, this person said. But the nearly completed project hit bureaucratic snags toward the end of last year and now I have no idea the status of it. A public private task force focused on securing technology supply chains co led by CISA and the IT and telecom sectors has effectively shut down following the loss of cipac. The task force's high level meetings, quote, have gotten canceled every week, unquote, a telecom industry representative said. Trump's cut have also forced out many of CISA's regional advisors who serve as field liaisons, connecting infrastructure operators with the agency's free guidance and services. As a result, CISA has gone off the grid in many states, the first water industry representative said. If all your CISA folks leave in your state, who are you supposed to call? Nobody's communicating that the loss of CISA advisors undermines infrastructure operators readiness to fend off cyber attacks, according to industry representatives who recounted these advisors providing briefings, participating in tabletop exercises, advertising free CISA services like vulnerability scans and serving as emergency resources. Water systems operators were trained to reach out to those CISA points of contact, said the first water industry representative. And now they don't know who to contact. So either information that needs to get to the government is not getting there or it's taking longer. In addition to the struggles at cisa, infrastructure operators have also reported problems with the specialized sector risk management agencies SRMAs that help various industries deal with cyber and physical threats. Around the time of the change in administrations, the EPA and CISA canceled a series of planned meetings with state water overseers, according to a third water industry representative. Hiccups like this have compounded what industry leaders said was the EPA's already anemic ability to help the sector withstand attacks. Hirsch, the EPA press secretary, said the agency will continue prioritizing staffing and resources for cyber support, adding that EPA considers cybersecurity one of its highest priorities. Meanwhile, the healthcare community is deeply concerned about the future of cyber aid from the Department of Health and Human Services. The Trump administration is demoting and restructuring the HHS wing that handles the department's SRMA work. It seems like they've taken a step back, a health care industry representative said. The sector used to meet regularly, sometimes weekly, with HHS to discuss critical infrastructure cybersecurity, Weiss said. But since the new administration, all of that's gone. Hhs did not respond to multiple interview and comment requests for this story. Members of the energy sector said their cyber partners of the Department of Energy and the Transportation Security Administration, which protects oil and gas pipelines, were trying their best but facing political headwinds, the second industry representative said DOE is busting its butt to help industry despite a lack of leadership support, while the remaining staffers at the TSA are trying really hard to save the ship. Doe and TSA did not respond to requests for comment. There's a degradation of support that's happening, said Caitlin Durkovich, who served as Biden's deputy homeland security advisor for resilience and response. As Trump appointees have pushed to shrink their agencies, key points of contact for infrastructure operators have left the government, leaving companies and their trade groups in the dark about who to call for cybersecurity help. Those departures have eroded important trust relationships between the public and private sectors. Quote, if I get a phone call from somebody at CISA who's worked incident response efforts for me, I'll drop everything and take that call because I know it's important and likewise, if I call them, they're going to answer my call, weiss said. If we don't have the ability to interact on a regular basis like this, and if the players change, we're not going to have those relationships. And this isn't just the trust that takes time to build. It's not just trust that takes time to build. Departing staffers had built up substantial knowledge about the sectors they worked with, said Daniel, the former White House cyber advisor. And the government has now lost the benefit of that expertise, which will be difficult to replace. As they navigate canceled meetings and missing points of contact, industry officials say they're not waiting around for the government to tell them how to protect their sectors. It's become even more evident that the private sector's got to take an active role here because of all the cutbacks, weiss said. Infrastructure operators proudly tout the fact that they, not the government agencies, already have most of the technical expertise necessary to operate and protect their systems, but they worry about filling any void in information sharing left by a shrinking government. Some critical infrastructure communities are now worried about what would happen in the event of a devastating cyber attack. If there's a major sector incident, I worry about the response capability of the government, weiss said. With the current level of support from the government, one water industry representative said a widespread intrusion into water systems could be disastrous. Asked about the government's ability to help contain a major hack in the natural gas sector, the second energy industry representative said, I no longer know this industry. Pessimism has only exacerbated the alarm that many cyber experts feel about recent events. Quote, we really can't afford to roll back the capabilities and strength that come from public private collaboration, said Phil Rettinger, president and CEO of the Global Cyber Alliance. The risk is too great. So you know there's a great deal of hand Wringing. And the question to ask would be whether CISA and the various other agencies that were paired back or eliminated, were needed, can be replaced. And certainly how we move forward from here at this moment, you know, in time, it sounds as though, well, we're somewhat more vulnerable and uncoordinated than we were going to be in the long term. We'll figure out, I think. I mean, it sounds like government support has shrunk. Infrastructure agencies are scrambling to pick up the slack that it seems to me the biggest problem is the loss of, of, you know, private public partnerships and communications. They're just, you know, that got broken. And so that needs to get figured out.
