Former intelligence officials denounce job cuts to federal cyber roles

Former cyberintelligence officials expressed concerns with recent terminations of cybersecurity roles in the federal government, arguing that the firings will strain U.S. digital posture and reduce incentives to attract top cybersecurity talent to government.

In a Wednesday hearing before the House China Select Committee discussing Chinese cyber threats, Rob Joyce — who led the National Security Agency’s cybersecurity division for three years under the Biden administration — said he has “grave concerns” that the “aggressive threats to cut U.S. government probationary employees will have a devastating impact on the cybersecurity and our national security.”

The Office of Personnel Management recently ordered that probationary employees — those who have been in the federal workforce for less than one or two years and have fewer civil service protections — be let go across all government agencies. After a judge ruled OPM’s order that other agencies remove staff unlawful, the Trump administration retroactively revised its probationary firing guidance this week to clarify that it did not mandate such firings.

Many of those reductions have hit the Cybersecurity and Infrastructure Security Agency. Among the many staffers already cut, several were hired under a new Cybersecurity Talent Management System program, which was designed to lure top technical talent from the private sector by offering them comparatively higher salaries. Those new hires, coupled with the relatively young age of the agency, made CISA a prime target for significant cuts because of the agency’s hefty volume of probationary hires.

“At my former agency, remarkable technical talent was recruited into developmental programs that provided intensive unique training and hands-on experience to cultivate vital skills,” said Joyce, adding that eliminating probationary employees in the federal workforce “will destroy a pipeline of top talent” needed to hunt for and stop hacking threats.

CISA, as well as the NSA and other intelligence agencies, were among several extended a deferred resignation offer that would let staffers remain on the payroll with full benefits until the end of September.

In testimony, Laura Galante, the intelligence community’s former cybersecurity executive who led the Cyber Threat Intelligence Integration Center in the Office of the Director of National Intelligence, concurred with Joyce.

“I’ll also say that with [the Cybersecurity and Infrastructure Security Agency], in particular, the work that CISA does and the advisories that go out with numerous agencies’ seals on them as a voice from the U.S. government about what needs to be protected, have a powerful message to our allies into other entities looking for advice on what they need to patch and do in their systems,” she said.

She was referring to numerous security advisories rolled out by CISA and government partners over the years that are designed to help victims take technical steps to remediate exposures in their networks or jettison hackers out of their systems.

Galante later added that CISA’s workforce “is building out a real ability to communicate with state, local and other entities who have the tough job of really securing networks, whether it’s that energy provider out in a local district, or whether that’s a company that’s just looking for best practices.”

“This is the way that a federal agency is able to push those lessons and push that support out to the edge across the U.S.,” she said.

CISA has faced GOP criticism for working with social media companies to counter disinformation. Legal challenges further intensified that scrutiny, with a 2023 lawsuit alleging that CISA’s coordination with social media platforms violated the First Amendment by suppressing conservative viewpoints. 

While the Supreme Court ultimately upheld the Biden administration’s efforts in 2024, CISA adapted its approach, halting direct flagging of misleading content while continuing to advise state and local officials on disinformation tactics.

At her confirmation hearing, DHS Secretary Kristi Noem emphasized a need for a leaner, more agile CISA and reaffirmed her stance that the agency should no longer engage in countering misinformation and disinformation on social media. 

Following this, DHS Assistant Secretary Tricia McLaughlin said last month that CISA is conducting an internal review of its election security work, leading to the administrative leave of personnel involved in disinformation monitoring and foreign influence operations. Shortly after, a senior DHS official confirmed that CISA had also terminated federally funded support for the Election Infrastructure Information Sharing and Analysis Center, a key threat intelligence group for election security.

Asked whether China has stopped looking at potentially interfering with future U.S. elections via cyberattacks, Joyce said he has “no reason to believe they have.”