Former CISA Chief Warns of Politicization Threatening U.S. Cybersecurity
By Archyde News Service
SAN FRANCISCO—Jen easterly, who served as director of the Cybersecurity and Infrastructure Security Agency (CISA) for five years, is raising alarms about the escalating politicization of cybersecurity under the Trump administration. Speaking ahead of the RSA Conference next week,Easterly voiced her concerns in a LinkedIn post, highlighting the recent firings and targeting of key cybersecurity officials.
Easterly Condemns Actions Against Cyber leaders
Easterly specifically cited the removal of Gen.Timothy Haugh as director of the National Security Agency (NSA) and commander of U.S. Cyber Command, along with his deputy Wendy Noble, as well as the investigation into former CISA director Chris Krebs, as evidence of a disturbing trend. “What’s happening now is not a policy disagreement, but something dark: the targeting and removal of nonpartisan public servants and the normalization of loyalty oaths to something other than our Constitution,” she wrote. “And if we — who aim to protect critical systems — can’t defend the humans who manage and maintain them, what exactly are we securing?”
The RSA conference, a major cybersecurity event held annually in San Francisco, is expected to draw thousands of industry professionals, government officials, and researchers. Easterly’s comments are likely to fuel debate about the role of politics in cybersecurity and the potential impact on national security.
Krebs Targeted After Defending Election Integrity
The targeting of Chris Krebs, who left his senior position at cybersecurity company sentinelone last week, has drawn particular scrutiny.The Trump administration announced an investigation into his activities as director of CISA, following an April 9 memo that revoked Krebs’ security clearance. The memo ordered a broad probe into “any instances where Krebs’ or CISA’s conduct appears to be contrary to the administration’s commitment to free speech and ending federal censorship,” particularly during the 2020 presidential campaign. The order also ordered a review of security clearances with individuals connected to SentinelOne.
easterly defended Krebs, stating he was targeted as he “had the courage to speak the truth about the security of our elections.” Trump originally fired Krebs after the CISA director said the 2020 elections had been conducted fairly.
Silence from Industry Leaders Deplored
Easterly acknowledged that some cybersecurity leaders “have spoken out” in support of those targeted but noted that “most prominent leaders and companies have stayed quiet, only issuing private messages of support.” She argued that this silence risks “hollowing out” and “politicizing” the federal cyber ecosystem.
She specifically called out the industry’s lack of public backing for Haugh, Krebs and Noble, arguing that cybersecurity “doesn’t exist in a vacuum” and that the actions are part of a larger trend.
“If we stay silent when experienced, mission-driven leaders are sidelined or sanctioned, we risk something greater than discomfort; we risk diminishing the very institutions we are here to protect,” Easterly stated. “If we allow the quiet dismissal of dedicated public servants in our community to pass without comment — we’re not defending national security; we’re compromising it.”
Cybersecurity Under Siege: A Critical Juncture
Easterly’s warnings come amid a surge in refined cyberattacks targeting U.S. infrastructure and government agencies. The U.S. Government Accountability Office (GAO) recently found that nearly all federal agencies don’t have sufficiently trained cybersecurity staff.
These include ongoing threats from Chinese state-sponsored hackers targeting the country’s telecommunications systems and the Treasury Department. The Justice department indicted seven Chinese nationals earlier this year for their roles in a global hacking campaign targeting U.S. businesses and critical infrastructure. In February 2025, the White House issued an executive order aimed at bolstering national cybersecurity defenses, highlighting the urgent need to address vulnerabilities across all sectors.
Easterly added: “The biggest vulnerability we face isn’t a zero-day in our software. It’s a zero-day in our civic integrity,” she said. “And the patch requires all of us.”
Counterargument: Prioritizing Loyalty and Accountability
Some argue that prioritizing loyalty to the administration and ensuring accountability are essential for effective governance. Proponents of the recent personnel changes might contend that they are necessary to align cybersecurity efforts with the president’s strategic objectives and to address perceived failures in leadership. They might also argue that those removed from their positions exhibited biases or failed to adequately address emerging threats.
The Broader Context: Workforce cuts and Resignations at CISA
easterly’s comments also come amidst concerns about the Trump administration’s handling of cybersecurity-focused scandals and the decisions to cut hundreds of workers from CISA. In addition to widespread firings at CISA, two top officials resigned this week, raising alarms about the agency’s ability to handle multiple current crises. Easterly said in her post that their mission is not just about availability and uptime but about trust.
FAQ: Cybersecurity and Political Interference
Question | Answer |
---|---|
Why is the politicization of cybersecurity a concern? | Politicization can undermine the nonpartisan expertise and trust necessary to effectively defend against cyber threats,potentially compromising national security. |
What is CISA’s role in U.S. cybersecurity? | CISA is the lead federal agency for cybersecurity, responsible for protecting critical infrastructure and providing cybersecurity services to federal, state, and local governments, as well as the private sector. |
What are zero-day vulnerabilities? | Zero-day vulnerabilities are security flaws in software that are unknown to the vendor, making them particularly risky as there is no patch available to fix them. |
How can businesses protect themselves from cyberattacks? | Businesses can protect themselves by implementing strong cybersecurity practices, including regular software updates, employee training, multi-factor authentication, and robust incident response plans. |
What is the RSA Conference? | The RSA Conference is a leading cybersecurity conference, bringing together industry professionals, government officials, and researchers to discuss the latest trends, challenges, and solutions in cybersecurity. |