#cisa

John Oliver is back from break. 😁🎉

He devoted his main segment this week to the Department of Homeland Security (DHS) which includes ICE and CBP.

John looks at the problems with DHS which began almost immediately after it was formed in late 2002.

The unwieldy bureaucracy, massive waste, and threat to civil liberties were bad enough. Then Trump put dog-killer Kristi Noem in charge of this department. What could possibly go wrong?

DHS is currently shut down due to a budget impasse in Congress. Now is an excellent time to contact the people who represent you on Capitol Hill to let them know that you think DHS needs a HÜGE overhaul.

I generally keep politics out of my reports. This blog is focused on cybersecurity and related tech issues. But today, politics is inextricable from my usual reporting. As part of the Department of Homeland Security shutdown effective on Saturday the 14th, CISA is currently operating with only a skeleton crew. And without pay.

NPR has listed a handful of things that may happen during the shutdown, which stems from a failure to reach a budget agreement to fund ICE, although evidently the expectation is that ICE operations will continue unabated without funding (we’ll see). CISA’s reduction to a fraction of its workforce was not listed among them, which is fairly indicative of how cybersecurity is viewed overall: as a low priority and acceptable collateral damage. And yet, where would we be without it?

Among the highlights on my cyber news feed are a ClickFix campaign variant using DNS lookups to stage malware payloads that include loaders and infostealers, as well as some remote access tools. These often target large informational hubs like federal departments. Another article covers the discovery of hundreds of Chrome extensions that have been harvesting user data. They have been exfiltrating data from emails and browser activity, with some extensions presenting themselves as AI tools, ad blockers or analytics utilities.

Acting CISA leader Madhu Gottumukkala recently commented, “When the government shuts down, our adversaries do not.” I’ve said it before myself, threat actors do not stop because their avenues of attacks are cut off from them. The danger here is that those avenues will have delays in being found in the first place, because there are simply not enough people looking for them. The KEV catalog will continue to be monitored and potentially updated, but just about everything else that we rely upon CISA for will not for the interim. Altruism may keep some workers at their posts, but that will only go so far. With only 38% of the department remaining in place – equally as furloughed as the rest of their coworkers – there is just too much work and not enough hours in the day. Not to mention, few people feel motivated to keep working without recompense or gratitude.

In essence, for the time being, threat detection is in the hands of individual entities, or people like myself, who do this research as part of our jobs. That means validating exploitations, understanding the availability of any patches, and liaising with federal agencies. How many of us are trained to do that? And even if we are, how many of us are have practice doing it? There will be delays, both in discovering incidents and remediating them. Some are likely to be missed, and we won’t know what the true extent of the damage is until much later.

My advice to my peers is to be prepared for more work, frustration and burnout. And to remember that this is a midterm election year. If we want to have a functioning government, then we need to elect public servants – because that is what politicians are, even if they forget that much of the time – who will effectively do their jobs. I myself am not going anywhere. I will continue to report on cyber news and issues. I just can’t make any promises on being quick about it.

"The Department of Homeland Security (DHS) has been shutdown since February 14th after Congress voted down its FY2026 appropriations bill. While the department was shut down over specific disagreements on ICE and Border Patrol funding, other agencies have also been subjected to funding lapses, including the Transportation Security Administration (TSA), Federal Emergency Management Agency (FEMA), Cybersecurity and Infrastructure Security Agency (CISA), and U.S. Coast Guard (USCG).

Because of the prolonged funding lapse, TSA agents have missed paychecks and begun to quit, and airport security lines have stretched out for hours. Trump now threatens to illegally deploy ICE agents to airports to handle security if Democrats do not pass DHS funding. However, Senate Democrats have repeatedly tried to pass funding carveouts for all DHS agencies except ICE and Border Patrol; Senate Republicans have blocked their passage.

Bill Bramhall

* * * *

LETTERS FROM AN AMERICAN

April 12, 2025

Heather Cox Richardson

Apr 13, 2025

It was just 20 days ago—on March 24—that editor in chief of The Atlantic Jeffrey Goldberg reported that the most senior members of the Trump administration discussed a military strike on the Houthis in Yemen on an unsecure commercial messaging app and that they included him on the chat.

Their Signal chat, which Goldberg published later in response to the administration’s insistence that there was nothing classified in the chat, showed that Secretary of Defense Pete Hegseth had posted precise details of the munitions and planes involved in the strikes. It showed that neither President Donald Trump nor the acting chairman of the Joint Chiefs of Staff—a Biden appointee—was on the chat, and that White House deputy chief of staff Stephen Miller apparently made the decision to strike based on his interpretation of what President Donald Trump wanted. In violation of the Presidential Records Act, the app was set to delete the messages. There was apparently no larger strategy or diplomatic plan other than to strike, and participants greeted news of the collapse of an apartment building into which a Houthi leader had allegedly walked with emojis of fists, fire, and a U.S. flag.

This extraordinary lapse in national security protections would normally have defined an administration and caused a number of resignations, but the White House called the case “closed” on March 31. And there was more: On April 2, Dasha Burns of Politico reported that the team working with national security advisor Mike Waltz regularly used the unsecure Signal app to communicate about issues involving Ukraine, China, Gaza, the Middle East, the U.S., and Europe. The officials to whom Burns spoke said they had personal knowledge of at least 20 such chats.

That story has been almost completely driven out of the news by President Donald Trump’s tariff machinations since April 2. On that day, after teasing the idea of what he called “Liberation Day,” Trump announced that at 12:01 a.m. on Wednesday, April 9, he would be imposing a 10% tariff on all imports to the United States, with significantly higher rates on countries he claims engage in unfair trade practices. By the next day it had been established that his team, led by trade advisor Peter Navarro, arrived at the tariff rates with a nonsensical formula that simply took the U.S. trade deficit with a country, divided it by the value of that country’s exports to the U.S., and cut the resulting number in half.

For the next week, the stock market plummeted, jumping only with rumors that Trump would back off on the tariffs, while economists and financial analysts revised the chances of inflation and recession upward, and economic growth downward. News coming out of the White House was contradictory: one advisor would say that Trump would not negotiate over tariffs and they were here to stay, while another would say he intended to negotiate and they were just starting points.

Meanwhile, as predicted, other countries began to put tariffs on goods from the United States or pause exports, and global markets fell. Americans from business leaders to small business owners to consumers and wage workers called out the “stupidity” of Trump’s trade war. Others noted that the tariffs appeared to be intended as a shakedown as countries or businesses who offered Trump the right price could get exemptions.

As trillions of dollars in stock values evaporated, Trump insisted the tariffs were here to stay. “I know what the hell I’m doing,” Trump told Republicans on Tuesday, April 8. He boasted that global leaders were “kissing my ass.” On Wednesday, April 9, at 9:33 a.m, he posted: “BE COOL! Everything is going to work out well. The USA will be bigger and better than ever before!” At 9:37, he posted “THIS IS A GREAT TIME TO BUY!!! DJT”

But, as Tyler Pager, Maggie Haberman, Ana Swanson, and Jonathan Swan of the New York Times reported, Trump’s team, led by Treasury Secretary Scott Bessent, was worried about setting off a financial panic that could not be stopped. Driving their concern was a broad sell-off of U.S. government bonds, which in the past investors had seen as a safe haven during times of market turmoil, and the rise in popularity of the government bonds of other countries.

Former treasury secretary Lawrence Summers noted that global financial markets were backing away from U.S. assets. Fund manager at Penn Mutual Asset Management George Cipolloni told Bernard Condon and Stan Choe of the Associated Press: “The fear is the U.S. is losing its standing as the safe haven. Our bond market is the biggest and most stable in the world, but when you add instability, bad things can happen.”

On April 8, U.S. Trade Representative Jamieson Greer defended Trump’s tariffs to the Senate Finance Committee. He was offering similar testimony before the House Ways and Means Committee at 1:18 p.m. when a social media post from Trump pulled the rug out from under him. Trump paused most of the highest tariffs for 90 days and instituted an across-the-board tariff of 10% in their place. But, perhaps unwilling to look weak, he announced that he was raising tariffs on goods from China to 125% effective immediately, “[b]ased on the lack of respect that China has shown to the World’s Markets.”

With Trump’s tariff pause, stocks jumped upward in one of the biggest single-day gains since World War II. Hedge fund manager Spencer Hakimian posted a graph showing that Nasdaq call volume—bets that stock values would rise—spiked minutes before Trump’s announcement. He commented: “Not a good look at all.” Representative Alexandria Ocasio-Cortez (D-NY) reposted Hakimian’s post and added: “Any member of Congress who purchased stocks in the last 48 hours should probably disclose that now. I’ve been hearing some interesting chatter on the floor. Disclosure deadline is May 15th. We’re about to learn a few things. It’s time to ban insider trading in Congress.”

David Smith of The Guardian noted that the juxtaposition of Trump golfing, dining with donors, and meeting with race car drivers even as economic chaos tanked people’s retirement accounts prompted accusations that he has lost touch with reality. A widely circulated video that appears to be Trump bragging to NASCAR drivers visiting the White House that investor Charles Schwab made $2.5 billion on Wednesday and that another investor made $900 million has fed anger at Trump’s economic chaos. On Friday the University of Michigan released its well-respected consumer-sentiment index, showing that consumer sentiment about the economy and personal finances fell for the fourth straight month, dropping 11% from March. Consumers from all political affiliations fear recession, inflation, and unemployment.

This level of consumer sentiment is the second lowest since the index began in 1952. Chief U.S. economist at Pantheon Macroeconomics Samuel Tombs told the Wall Street Journal’s Harriet Torry: “Consumers have spiraled from anxious to petrified.” James Knightley, the chief international economist at the multinational banking and financial services company ING, noted that consumers appear to blame Trump for their concerns. While in January 44% of respondents told researchers that the government was doing a poor job of managing inflation and unemployment, now 67% say so.

The change happened so quickly that White House officials could not tell reporters what the actual tariff rates were for different countries. When more information was available, Kevin Schaul of the Washington Post noted that Trump’s new tariff levies had actually increased tariffs rather than lowered them because he had dropped rates only on goods from countries that don’t export much to the U.S. He had raised them significantly—not just to 125% but to 145%—on China, a major trading partner.

On Friday, China imposed 125% tariffs on goods from the U.S. A spokesperson for the Chinese Finance Ministry said that Trump’s tariff machinations “will become a joke in the history of the world economy.” At 9:20 a.m. President Trump posted: “We are doing really well on our TARIFF POLICY. Very exciting for America, and the World!!! It is moving along quickly. DJT.” The new tariffs had badly threatened Apple Inc., and at 10:36 p.m. the U.S. Customs and Border Protection posted a notice that various electronics, including smartphone and computer monitors, are exempt from the tariffs.

When economist Justin Wolfers commented: “I just want to tip my hat to the crack team of White House economists who were able to discover—in just a few short days—that the U.S. is dependent on China for smartphones, computers and semiconductors.” Dr. Soumya Rangarajan noted that “a basic medicine we use 1000x per day in the hospital, heparin, is also dependent on China, and people will die without it.” As Sabrina Malhi of the Washington Post explained, about 12 million people hospitalized in the U.S. need heparin every year, and it is only one of the many medications that will be affected by Trump’s tariffs on goods from China.

Josh Marshall of Talking Points Memo posted that a “[g]ood way to see the current tariffs, as of literally today, is no tariffs on high value add manufactured goods marketed to middle and upper middle classes. Massive tariffs for cheap consumer items” that benefit those lower on the economic ladder.

While the damage from the tariffs both to the domestic and global economy, as well as the USA’s standing in the world, is not yet clear—all the chaos has been about the prospect of Trump’s high tariff rates, not their actual effect—Trump appears to be trying to downplay that story in favor of demonstrating his power.

As the tariff saga played out on Wednesday, Trump signed a memorandum for the heads of executive departments and agencies informing them that they no longer need to let the public know when they get rid of regulations that they determine are obviously unlawful. Kate Riga of Talking Points Memo notes that “unlawful” appears to mean anything Trump doesn’t like.

In a breathtaking violation of the Constitution, on Wednesday Trump also went after two individuals: Christopher Krebs and Miles Taylor. Trump appointed Krebs to head the Cybersecurity and Infrastructure Security Agency (CISA), where in 2020 Krebs assured the American people that the presidential election had not been stolen. Trump now claims Krebs thus censored the speech of Trump loyalists.

As a Department of Homeland Security staffer, Taylor wrote an op-ed under the pseudonym “Anonymous” saying that members of the first Trump administration were pushing back against the president’s policies. Taylor later wrote a book about his time in the White House that Trump claims was “designed to sow chaos and distrust in Government” and thus “could properly be characterized as treasonous and as possibly violating the Espionage Act.” A grand jury believed Trump himself violated the Espionage Act by retaining classified documents.

Trump stripped security clearances from Krebs and Taylor and also from their employers. He ordered government officials to investigate the two men and to recommend “appropriate remedial or preventative actions to be taken to protect America’s interests.” Employees at CISA told Kevin Collier of NBC News they were disheartened by the attack on Krebs and noted that staffing cuts at CISA had “already severely degraded our capacity to defend critical infrastructure.”

LETTERS FROM AN AMERICAN

CISA added CVE-2026-31431 in the Linux kernel to its KEV catalogue after confirming active exploitation enabling local privilege escalation attacks. Federal agencies are required to remediate the flaw under Binding Operational Directive 22-01 to reduce exposure to ongoing intrusion attempts.

Source: Cybersecurity and Infrastructure Security Agency

22 minutes ago Carl Hulse Reporting from Capitol Hill

Senate and House Republicans revived a deal that Trump and the House G.O.P. rejected last week.

Senate and House Republicans announced an agreement on Wednesday to move ahead as early as Thursday morning with legislation to reopen the Department of Homeland Security, resurrecting a bipartisan deal that President Trump and the House G.O.P. angrily rejected last week.