Expect a Cyber Budget Boost But Stay Tuned for that Executive Order, Homeland Adviser Says

President Donald Trump’s budget, due out Thursday, will include early indications of a broad plan to upgrade the security of federal networks, Trump’s top homeland security adviser said Wednesday.

Don’t expect a multibillion-dollar investment that will modernize government cybersecurity in one fell swoop, though, Homeland Security Adviser Tom Bossert said during an address at the Center for Strategic and International Studies think tank.

Also, don’t expect a long-rumored executive order that outlines Trump’s cybersecurity plan in the near future, he said, suggesting it will be weeks or months before the order is released in its final form.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

Trump’s broad plan to improve government security will include holding top government officials accountable for breaches and vulnerabilities at their agencies, and improving the way federal agencies share cybersecurity services provided by the Homeland Security Department and others, Bossert said.

Protecting federal networks is something Trump views as “an absolutely solemn responsibility,” he said, and the president “doesn’t view it kindly that we have bureaucrats viewing this as a responsibility among others and questions about priorities.”

Bossert spoke for about 45 minutes at CSIS’ Cyber Disrupt conference and did not take audience questions. It was the first formal address on the Trump administration’s cybersecurity priorities since the president took office.

Bossert described the nation’s cybersecurity as in a state of general crisis.

“As I come back to this world, I feel like I have re-awoken from a long 8-year nap and I found a world that is on fire,” he said.

In addition to outlining Trump’s broad cyber priorities, Bossert confirmed the National Security Agency's top hacker, Rob Joyce, will become White House cybersecurity coordinator.

He also confirmed the Trump administration will follow the Obama administration’s practice of pressing other nations to adopt norms of good behavior in cyberspace and will hold them accountable when they fail to live by those norms, Bossert said. He declined to call out specific nations.

Bossert’s address came the same day the Justice Department indicted two members of Russia’s intelligence service for hacking at least 500 million Yahoo email accounts. U.S. intelligence agencies have also concluded the Russian government hacked Democratic political groups during the 2016 election in an effort to help Trump’s electoral chances.

Trump has declined to criticize Russia for those breaches.

Bossert also swung against leakers of classified information during his address, saying, “people that have taken in the past—[Edward] Snowden and other people—things that they shouldn’t, are absolute enemies to our state. Period. They need to be caught and punished.”

Other elements of Trump’s cyber executive order will focus on protecting the “most critical” of critical infrastructure, Bossert said, and on combating botnets—armies of compromised computers and other devices hackers harness to attack websites.

Agencies will also be held responsible for reporting “known unmitigated risks” in their systems going forward and agencies will be assessed based on a range of cybersecurity metrics that will likely not be made public, he said.

“We all now know that antiquated hardware systems and antiquated … software systems holding millions and millions of important records for our national security was a bad approach,” Bossert said, referring to more than 20 million sensitive security clearance documents compromised in Office of Personnel Management systems. “That was a known and unmitigated risk.”

Agencies will also be required to adopt a cybersecurity framework developed by the National Institute of Standards and Technology, he said.

That requirement, which was included in an earlier leaked version of the executive order, was greeted with some skepticism at NIST, which has always insisted the framework should be a voluntary document.

Bossert pledged not to diminish the administration’s commitment to combating cyber crime and asked Americans to trust the administration’s commitment to protecting citizens’ privacy in the process.

“There will be people that don’t trust me and don’t trust the administration,” he said. “I think that’s something they should keep to themselves and hold and reserve judgment until they have some reason not to.”