Apr 11, 2019 8:21 PM

Trump’s Homeland Security Purge Worries Cybersecurity Experts

A leadership void at DHS means the White House is calling the shots where it wants to, cybersecurity experts warn, and other agencies can muscle in where it won’t.

This week kicked off a new, chaotic era at the Department of Homeland Security, where the only certainty seems to be the president’s obsession with immigration. As former Customs and Border Protection commissioner and prominent family-separation advocate Kevin McAleenan takes over as acting secretary, it’s fair to wonder what will happen to the rest of DHS’ many essential responsibilities.

The shakeup began last week, when President Trump announced he was withdrawing his nominee to head Immigration and Customs Enforcement, Ronald Vitiello, saying, “We’re going in a tougher direction.” Then on Sunday he ousted former secretary Kirstjen Nielsen, after months of rumors that he was unhappy with her performance. Secret Service director Randolph Alles and DHS undersecretary Claire Grady are also out, and there may still be more to come.

But DHS’ mandate goes far beyond immigration, to concerns like cybersecurity, counterterrorism, monitoring critical infrastructure, border privacy, and the development of science and technology in defense of the country. While Trump’s Homeland Security purge may not mean an immediate danger of those areas being neglected, former government officials worry about the long-term consequences of the hollowing out and restructuring of DHS.

“DHS’ cybersecurity operators don’t take a day off when they’re without top leadership, and to some extent, their day-to-day is insulated from the political level,” says R. David Edelman, former director for international cyber policy on President Obama’s National Security Council. "But absent leadership at the cabinet and deputy secretary level, DHS is going to start losing the fight for resources and its voice in interagency policy development—and that’s a cause for concern."

While Nielsen’s lasting legacy as DHS secretary may be her implementation of the Trump administration’s family separation policy, she also brought cybersecurity expertise to the job. Under Nielsen, Homeland Security shored up its cyber defenses with the creation of the National Risk Management Center, and it established the Cybersecurity and Infrastructure Security Agency. DHS also adopted controversial biometric and facial-recognition policies and restructured its domestic terrorism unit, much to the consternation of outside experts and some career workers within the agency. But Nielsen’s leadership on cybersecurity issues, for better or worse, stood out when the White House was cutting critical cybersecurity roles altogether, even as foreign hackers grew bolder.

Now Nielsen is gone, and it’s unclear whether any momentum on cybersecurity DHS had goes with her. As acting secretary, McAleenan technically has the same powers, but he can only hold the position for a limited number of days under US law (the standard is 210).

“There’s a lot of uncertainty of long-term strategic guidance,” says J. Michael Daniel, former cybersecurity coordinator during the Obama administration and current president of the Cyber Threat Alliance. “If someone in an acting position comes in and tries to take the department in a new direction, people are skeptical.”

President Trump has suggested that he likes having this limit on his cabinet secretaries, even though that’s probably not the intent of the law, and may not even be in accordance with it. “I like acting,” he told reporters in January. “It gives me more flexibility. Do you understand that? I like acting. So we have a few that are acting.”

There are more than a few top-level vacancies at DHS. According to The Washington Post’s tracker, only 39 percent of key Homeland Security positions are filled. Even before the past week’s purge, FEMA, which is under the umbrella of DHS, had no Senate-confirmed leader. Neither does the Office of Strategy, Policy, and Plans, the Science and Technology Directorate, nor the Office of the Inspector General.

“DHS’ voice is vital around the Situation Room table,” says Edelman. “Looking ahead, as we consider issues like national security controls over AI, or limits to foreign investment, DHS is going to be more crucial than ever—and that absence of leadership could lead to some very skewed outcomes.”

Outcomes like squabbling, misunderstandings, and deadlock—or even increased national security risk, if the department begins focusing only on immigration rather than its broader mandate. "DHS is once again focused on one risk at the exclusion of the others. Any nation that puts its entire weight behind just one security challenge (and steers dollars from other security needs, such as the military) is letting other vulnerabilities go unaddressed and ignored,” Juliette Kayyem, former assistant secretary of DHS in the Obama administration, wrote in an op-ed in the Post.

Consider the role DHS plays in something like attributing cyber threats against physical targets, for instance: The department helps negotiate between parts of the government with competing mandates—law enforcement may want to preserve evidence while other parts of the government just want to get machines and power turned back on. Without DHS empowered to moderate, who decides? It’s not immediately clear, according to Daniel.

“This just continues to contribute to the turmoil that has become a hallmark of this administration,” he says.

Edelman warns that some of the unintended consequences of a blunted DHS might not make the administration happy---like greater influence from the intelligence community on matters of national security. “The competition for cybersecurity resources and authorities is fierce, and when it comes to the operational gray zone—between domestic and international, public and private sector networks—a vacuum at DHS might be filled by overeager defense or intelligence agencies,” says Edelman.

Most crucially, it leads to policy paralysis. And that will hit even issues the administration is bullish on, like the development and implementation of secure biometrics. “Persistent vacancies in science and technology offices may well delay that process, slowing down the sort of long-lead-time, high-tech work we need for smarter border security, critical biodefense, and even WMD detection applications,” says Edelman.

The good news is that there are still Senate-confirmed leaders in charge of DHS subagencies like the Transportation Security Administration, the Office of Intelligence and Analysis, the Countering Weapons of Mass Destruction office, and the Cybersecurity and Infrastructure Security Agency. And the career federal workers who actually implement DHS policy are still there doing their jobs. They will be able to keep current policies going and respond to active emergencies.

But their jobs might get harder. “The career people can keep the trains running,” says Daniel. “The bigger issue is the long-term policy paralysis and the policy turmoil that this lack of permanence and long-term thinking will inevitably exact.”