White House directs agencies to consider staff reductions in case of shutdown

Summary

---

The Daily Scoop Podcast – Episode Summary

Title: White House directs agencies to consider staff reductions in case of shutdown
Date: September 29, 2025
Host: Billy Mitchell

---

Episode Overview

This episode centers on a directive from the White House’s Office of Management and Budget (OMB) to federal agencies, advising them to consider staff reductions if there is a government shutdown due to funding lapses. The episode also highlights a major federal cybersecurity alert concerning ongoing attacks exploiting Cisco Zero Day vulnerabilities in government infrastructure.

---

Key Discussion Points & Insights

1. White House Directive on Potential Staff Reductions

[00:26–02:52]

• OMB Guidance: Agencies are told to consider reducing employees on programs that may lose funding if a government shutdown happens at the end of the fiscal year (September 30, 2025).
  • “With respect to those federal programs whose funding would lapse and which are otherwise unfunded, such programs are no longer statutorily required to be carried out.” (White House message, 00:38)
• RIF Notices: The guidance refers to using “reduction in force” (RIF) notices for staff in projects that:
  1. Experience funding lapses on October 1,
  2. Do not have alternative funding sources,
  3. Are “not consistent with President Donald Trump's priorities.”
  • “The project, program, or activity must meet all three criteria, the message said.” (Host, 01:25)
• Political Tone: The message blames a potential shutdown on congressional Democrats, labeling their demands as “insane.”
  • “The message also places blame for a possible shutdown squarely on congressional Democrats calling their demands insane.” (Host, 01:33)
• Reference to Trump Administration Legislation: The “One Big Beautiful Bill Act,” central to Trump’s second term, is claimed to secure resources for core priorities.

2. Congressional Response to the Directive

[01:52–02:36]

• Criticism from Democrats: Senators Chris Van Hollen and Jeff Merkley issue strong objections in written statements:
  • Chris Van Hollen: Describes the directive as “a likely illegal threat that would harm federal workers who don’t have anything to do with the current policy disputes.” (Host quoting Van Hollen, 02:00)
  • Jeff Merkley: “This threat has nothing to do with keeping government open. It is just another strong arm attempt from Donald Trump and his hatchet man Russ Vaught, to dismantle the government piece by piece.” (Host quoting Merkley, 02:18)

3. Emergency Cybersecurity Directive Due to Widespread Attacks

[02:36–04:07]

• Federal Cyber Alert: The Cybersecurity and Infrastructure Security Agency (CISA) has issued a rare emergency directive amid active exploitation of zero-day vulnerabilities against Cisco firewalls across multiple agencies.
• Incident Details:
  • Cisco revealed ongoing attacks starting in May, linking them to a state-sponsored group previously dubbed “Arcane Door.”
  • Three key vulnerabilities identified: CVE2025-20333, CVE2025-20363, and CVE2025-20362. The first two were actively exploited.
  • Attacks included implanting malware, executing commands, and potentially exfiltrating data.
• Agency Response Requirements:
  • Federal agencies were ordered to hunt for evidence, report compromises, and disconnect affected devices immediately.
  • Required to apply patches or permanently disconnect unsupported Cisco ASA firewall devices.
  • CISA’s Message:

    “CISA is directing federal agencies to take immediate action due to the alarming ease with which a threat actor can exploit these vulnerabilities, maintain persistence on the device, and gain access to a victim’s network.” (CISA Acting Director Madhu Gautamakala, quoted by Host, 03:37)

• Vendor Transparency Questioned: Cisco waited four months from its initial response to these attacks to publicly disclose the activity and provide patches.

---

Notable Quotes & Memorable Moments

• White House Message:

  “With respect to those federal programs whose funding would lapse and which are otherwise unfunded, such programs are no longer statutorily required to be carried out.”
  (00:38, OMB Message via Host)

• Political Attribution:

  “The message also places blame for a possible shutdown squarely on congressional Democrats calling their demands insane.”
  (01:33, Host)

• Senator Jeff Merkley’s Critique:

  “This threat has nothing to do with keeping government open. It is just another strong arm attempt from Donald Trump and his hatchet man Russ Vaught, to dismantle the government piece by piece.”
  (02:18, Senator Jeff Merkley as quoted by Host)

• CISA Agency Warning:

  “CISA is directing federal agencies to take immediate action due to the alarming ease with which a threat actor can exploit these vulnerabilities, maintain persistence on the device and gain access to a victim’s network.”
  (03:37, CISA Acting Director Madhu Gautamakala via Host)

---

Timestamps for Key Segments

• White House Staff Reduction Directive Explained: 00:26–01:52
• Democratic Senators Respond to Directive: 01:52–02:36
• Cisco Zero Day Attacks and Federal Directive Details: 02:36–04:07
• CISA Official Quote & Response Requirements: 03:37–04:07

---

Tone and Language

The episode balances a straightforward news delivery style with direct quotes to illuminate both the urgency and controversy surrounding the White House directive and cybersecurity warning. The host, Billy Mitchell, maintains a factual and brisk style, letting official statements and notable quotes provide context and emphasis.

---

Conclusion

This episode delivers urgent updates on government workforce management under the possible government shutdown and highlights a critical federal cybersecurity challenge, providing essential information for government leaders and stakeholders navigating rapidly evolving scenarios in federal policy and IT security.

Transcript

[A]

Today on the Daily Scoop Podcast from the Scoop News Group, the White House directs agencies to consider staff reductions in the event of a shutdown and CISA alerts federal agencies of ongoing widespread attacks using Cisco Zero Days. It's Monday, September 29, 2025. Welcome to the Daily Scoop Podcast where you hear the latest news and trends facing government leaders.

[B]

I'm the host of the Daily Scoop Podcast, Billy Mitchell.

[A]

Thanks so much for joining me. And now let's dive into the day's top headlines. The White House's Office of Management and Budget is instructing agencies to consider reducing staff for programs that have a lapse in funding in the event of a government shutdown as tensions rise ahead of the Sept. 30 end of the fiscal year. In an undated message sent out last week, the White House said, quote, with respect to those federal programs whose funding would lapse and which are otherwise unfunded, such programs are no longer statutorily required to be carried out. The guidance goes on to say that consistent with applicable law, including a federal reduction in force statute, agencies are directed to use this opportunity to consider RIF notices for employees working in projects, programs or activities that have a funding lapse on October 1, don't have another source of funding, and are not consistent with President Donald Trump's priorities. The project, program or activity must meet all three criteria, the message said. The message also places blame for a possible shutdown squarely on congressional Democrats calling their demands insane. The message also explains that the One Big Beautiful Bill act legislation passed earlier this year that is at the heart of Trump's second term agenda provided ample resources to ensure that many core Trump administration priorities will continue uninterrupted. Democrats decried the message in a written statement. Senator Chris Van Hollen of Maryland, ranking member of the Senate Appropriations Subcommittee on Commerce, Justice, Science and Related Agencies, described the tactic as a likely illegal threat that would harm federal workers who don't have anything to do with the current policy disputes. And Senator Jeff Merkley of Oregon, ranking member of the Senate Budget Committee, similarly said in a written statement that, quote, this threat has nothing to do with keeping government open. It is just another strong arm attempt from Donald Trump and his hatchet man Russ Vaught, to dismantle the government piece by piece, unquote. In other news, federal cyber authorities sounded a rare alarm last week, issuing an emergency directive about an ongoing and widespread attack spree involving actively exploited zero day vulnerabilities affecting Cisco firewalls. Cisco said it began investigating attacks on multiple government agencies linked to the state sponsored campaign in May. The vendor, which attributes the attacks to the same threat group behind an early 2024 campaign targeting Cisco devices that are dubbed Arcane Door, said the new zero days were exploited to implant malware, execute commands and potentially exfiltrate data from the compromised devices. Cisco disclosed three vulnerabilities affecting its adaptive security appliances. Those are CVE 2025 20333, CVE2025 20363 and CVE2025 20362, but said evidence collected strongly indicates that CVE2025 20333 and CVE2025 were used by the attacker in the current attack campaign. The Cybersecurity and Infrastructure Security agency said those 2zero days pose unacceptable risk to federal agencies and require immediate action. Federal agencies were required to hunt for evidence of compromise, report findings and disconnect any compromised devices by the end of the day last Friday. Agencies running Cisco ASA firewalls are also required to apply Cisco's patches or permanently disconnect end of life devices. CISA Acting Director Madhu Gautamakala said CISA is directing federal agencies to take immediate action due to the alarming ease with which a threat actor can exploit these vulnerabilities, maintain persistence on the device and gain access to a victim's network. Cisco did not fully explain why it waited four months from its initial response to the attacks on federal agencies to disclose the malicious activity and patch the zero day vulnerabilities. For more news at the intersection of the federal government and technology, make sure to visit fedscoop.com thanks so much for.

[B]

Tuning in to another episode of the Daily Scoop Podcast, available on all podcast platforms.

[A]

If you've already rated the podcast on.

[B]

Your platform of choice, thanks so much. High ratings and good reviews of the show help more people to find it. The Daily Scoop Podcast is a production of the Scoop News Group in Washington, dc. Adam Butler and Carlin Fisher help put the show together and the entire Scoop News Group team contributes. We'll be back tomorrow with more top headlines. Until then, I'm your host as always, Billy Mitchell. Thanks so much for listening.