Wednesday, January 29

For this week’s Eye On The Right, I wanted to share, in full, my latest deep dive on the Cybersecurity and Infrastructure Agency (CISA) — a little-known federal agency within the Department of Homeland Security (DHS) that has become crucial for securing elections. Project 2025 called for gutting the agency completely and, since President Donald Trump’s return to the White House, steps have been taken to strip the agency of most of its advisory power, thanks to a memo from Acting DHS Secretary Benjamine Huffman terminating "all current memberships on advisory committees within DHS, effective immediately," which includes the CISA cybersecurity advisory committee.

How did CISA become such a crucial agency for federal and state elections? And what does gutting CISA mean for the future of election security? See below.

As always, thanks for reading.

— Matt Cohen, Senior Staff Writer

Lawsuits over birthright citizenship, DOJ actions and more are already underway and Democracy Docket is closely following every update. Upgrade now for $120/year to stay ahead of the curve and get the most crucial updates with exclusive analysis sent straight to your inbox.

A Little-Known Federal Agency Helps Secure Elections. Trump Wants to Gut It.

Buried deep within Project 2025 — the Heritage Foundation’s 900-page blueprint for how the new conservative administration can slide the government into an authoritarian regime — is a cursory section suggesting reforms for a relatively new, little-known federal agency called the Cybersecurity and Infrastructure Security Agency (CISA).

Formed in 2018 within the Department of Homeland Security (DHS), CISA is responsible for cybersecurity and infrastructure protection across the government. Though it’s somewhat nascent, it’s quickly become one of the federal government’s core agencies in protecting the country from cyber attacks and coordinating with state and local officials to help with cyber threats — including election threats — they otherwise aren’t equipped to handle.

Considering the size and scope of Project 2025, the section devoted to CISA is miniscule — less than 400 words in all. But what that brief section proposes for the agency could have grave implications for the future of elections — and democracy.

“The Cybersecurity and Infrastructure Security Agency (CISA) is a DHS component that the Left has weaponized to censor speech and affect elections at the expense of securing the cyber domain and critical infrastructure, which are threatened daily,” writes Ken Cucinelli, Trump’s former deputy secretary of Homeland Security, in the DHS chapter of Project 2025. “A conservative Administration should return CISA to its statutory and important but narrow mission.”

With President Donald Trump’s return to the White House — and his promise of retribution to his political enemies and a radical overhaul of the federal government to his liking — election and cybersecurity experts are rightly sounding the alarm bells about Project 2025’s proposed gutting of CISA.

A New Agency Becomes a Lauded Election Resource

CISA came into existence in November 2018, with Trump signing the Cybersecurity and Infrastructure Security Agency Act into law to officially create the agency. “Every day, America’s adversaries are testing our cyber defenses. They attempt to gain access to our critical infrastructure, exploit our great companies, and undermine our entire way of life,” Trump said at the time of CISA’s launch. “This vital legislation will establish a new agency within the Department of Homeland Security to lead the federal government’s civilian response to these cyber threats against our nation.”

The seeds of CISA date back to 2007, when the DHS started a program called the National Protection and Programs Directorate (NPPD) to address cybersecurity threats. But once that program became a fully fledged agency, the scope of its mission expanded to beef cybersecurity and infrastructure across the government — and help provide state and local governments with desperately needed resources in cybersecurity. And a big part of that scope was election security from cyber threats, which prior to 2016 wasn’t exactly a major issue.

“There was really no federal agency before CISA that was providing any sort of comprehensive election security support to state and local election officials,” Derek Tisler, a counsel in the Brennan Center’s Elections and Government Program, explained to Democracy Docket. “And it obviously has become more important as the election security threat environment has changed so much — especially since 2016, when we really started to see the potential for interference in our elections.”

Throughout the 2016 election, there was a massive effort from Russian nationals to interfere with the election to boost Trump’s campaign. Russian hackers, at the behest of President Vladimir Putin, hacked the Democratic National Committee, and engaged in a widespread disinformation campaign throughout social media platforms. It was an effort that the country — especially state and local election officials — were wholly unprepared to handle.

“It put local election officials into a role as national security figures, a role that they are really just not equipped for because elections are run at the local level,” Tisler said. “Local election offices have very, very limited capacity, and that capacity is dedicated towards running an election.”

Enter CISA, which Tisler says was the “first attempt to package the unique knowledge and expertise of the federal government in a way that is directly helping state and local officials on the ground run elections.” The agency very quickly established itself as a vital tool for training and providing resources to local election officials, earning bipartisan praise for its work.

Kim Wyman, who served as Washington’s secretary of state from 2013 to 2021, left her role to go work on election security at CISA. As Washington’s top election official, she experienced firsthand how the work of CISA helped local election officials. CISA, she said, was a “real game changer” as the agency didn’t just provide the infrastructure and cyber hygiene to help local election offices prevent various cyber threats and the spread of disinformation, but trained officials to better respond to attacks when they do happen.

“Before CISA, I think we were very much in the mindset of trying to prevent attacks, prevent people getting into our systems, prevent any kind of intrusion,” she told Democracy Docket. “And after 2016 because of some of the work we did with DHS and then eventually CISA, we shifted from a mindset of prevention to a bigger focus on that resiliency piece, and how to respond and recover.”

MAGA Turns on CISA

Things took a turn for CISA in the aftermath of the 2020 election — and the president who created the agency all of sudden wanted it gone.

In the weeks after the election, Trump and his acolytes spread disinformation about election fraud like wildfire, going on conservative TV networks and taking to Twitter to loudly claim, without evidence, that the election was being stolen. Christopher Krebs, CISA’s inaugural director who led the agency in its previous incarnation as DHS’s NPPD, pushed back on Trump’s election fraud claims. Krebs created a page on CISA’s website debunking election misinformation, which drew the ire of Trump and his MAGA contingent.

On Nov. 17, 2020, Krebs tweeted about Trump’s election fraud claims, writing that “59 election security experts all agree, ‘in every case of which we are aware, these claims either have been unsubstantiated or are technically incoherent.’” Trump fired him that day, writing on Twitter that “the recent statement by Chris Krebs on the security of the 2020 Election was highly inaccurate, in that there were massive improprieties and fraud — including dead people voting, Poll Watchers not allowed into polling locations, ‘glitches’ in the voting machines which changed votes from Trump to Biden, late voting, and many more.”

After that, Krebs became a major enemy in Trump world. Here was the nation’s top cybersecurity officer, whose agency — in just two short years — was highly praised and respected by politicians across the political spectrum for its work in election security debunking the president’s election fraud claims. Trump campaign attorney Joseph diGenova even went on Newsmax to say that Krebs “should be drawn and quartered. Taken out at dawn and shot.” (Krebs later sued diGenova, the Trump campaign and Newsmax for defamation).

Experts Fear Project 2025 Reforms

When Tisler read the suggested reformations to CISA in Project 2025, he wasn’t surprised given everything that happened with the agency in the aftermath of the 2020 election.

“Project 2025’s recommendations — essentially because this one thing caused anger — is to just strip the agency of all of its support altogether,” he said. “And CISA’s functions go so far beyond its role in the information space in a way that would do real harm to election officials and leave them less prepared to tackle future challenges.”

In the DHS chapter of Project 2025, Cucinelli suggests gutting CISA almost entirely, moving its core responsibilities on critical infrastructure to the Department of Transportation. It’s a suggestion that Adav Noti, the executive director of the nonpartisan voting rights advocacy organization Campaign Legal Center, previously described to Democracy Docket as “absolutely bonkers.”

“It’s located at Homeland Security because the whole premise of the Department of Homeland Security is that it’s supposed to be the central resource for the protection of the nation,” Noti said. “And that the important functions shouldn’t be living out in siloed agencies.”

But what’s most concerning about Cucinelli’s suggested reforms to CISA is how it relates to the agency’s election security work. “CISA has rapidly expanded its scope into lanes where it does not belong, the most recent and most glaring example being censorship of so-called misinformation and disinformation,” he writes. “Of the utmost urgency is immediately ending CISA’s counter-mis/disinformation efforts.” He says that CISA’s only role in election security is to help states and localities “assess whether they have good cyber hygiene in their hardware and software in preparation for an election—but nothing more,” and suggests that the agency should be less involved with local election offices the closer it is to an election.

“The recommendation that says this role should actually reduce as it gets closer to election day, it’s just completely backwards,” Tisler said. “That’s the moment where the support is most needed.”

Throughout Joe Biden’s presidency, CISA expanded its role and presence in elections, with people who work for the agency on the ground conducting cybersecurity assessments of election offices, along with physical security suggestions. “They offer more customized products. They offer incident response plans,” Tisler said. “That’s a crucial component.”

With Trump’s return to the White House, there’s understandable anxiety and fear that the Project 2025 suggestions to gut CISA might come to fruition. But Tisler doesn’t think it’ll happen without a fight.

“I would absolutely anticipate pushback,” he said. “Especially among state and local election officials from both parties who understand the value of this agency, understand how much the agency support has put them in a better position to run secure elections.”

Wyman left CISA in 2023 and, though she still keeps up with the agency, she’s unclear about what the new administration holds for its future.

“You have a lot of people speculating what the Trump administration is going to do and how they’re going to prioritize things,” Wyman said. “My hope is that as all of the different cabinet appointees get into their positions, and once they are approved by the Senate, when they actually start having the classified briefings with the intelligence community… I’m hoping that the politics fade a little bit because these are real threats.”