Dive Brief:

• The U.S. Department of Homeland Security has disbanded current memberships on all advisory committees within the agency, placing the future role of the Cyber Safety Review Board (CSRB) in question.

• Acting DHS Secretary Benjamin Huffman ordered the termination of all existing advisory committee memberships in a memo issued on Monday. He cited the agency’s commitment to “eliminating the misuse of resources” and to prioritizing national security issues.

• CSRB, created in 2022 under the Biden administration, launched an investigation late last year into the hacking of nine U.S. telecommunications firms. The attacks were attributed to Salt Typhoon, a threat group backed by the People’s Republic of China.

Dive Insight:

What remains unclear is how the CSRB will be affected by the decision, and what the move means for the telecom attacks probe as well as for future investigations into cyber threat activity.

Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, said the decision to turn over membership is fairly standard practice during a change in administrations.

“That said, the investigation into China’s Salt Typhoon compromise of American telecommunications companies is of paramount importance so that our nation can learn the lessons of what happened and how to prevent a repeat occurrence,” Fixler said. “Anything that diminished the CSRB’s ability to conduct a timely and thorough review is unfortunate.”

Bennie Thompson, ranking member of the House Committee on Homeland Security, expressed concern about the decision in an opening statement during a hearing Wednesday. 

“I am troubled that the president’s attempt to stack the CSRB with loyalists may cause its important work on the Salt Typhoon campaign to be delayed,” Thompson said in written testimony.

Chris Krebs, chief intelligence and public policy officer at SentinelOne, resigned from the CSRB on Saturday, two days before the memo was issued. Krebs was famously fired by Trump after he confirmed the security of the election results after Joe Biden won the presidential race in 2020. 

CSRB issued a blistering report in early 2024 following the state-linked hacks of Microsoft Exchange Online in 2023, where tens of thousands of emails were stolen from the U.S. State Department.

The board concluded that Microsoft had neglected cybersecurity concerns due to cultural failures at the company, including prioritizing speed to market and sales objectives.