The two expected incoming leaders of the Senate and House homeland security panels expressed reservations Tuesday about the Trump administration’s pick to lead the Cybersecurity and Infrastructure Security Agency because he currently works for the oft-controversial tech company Palantir.

The Trump administration on Monday announced its intent to nominate Michael LoSapio, chief information security officer for Palantir, to fill the long-vacant Senate-confirmed position of CISA director.

The Senate Homeland Security and Governmental Affairs Committee has authority over approving CISA director nominees. A spokesperson for its current chairman, Rand Paul, R-Ky., didn’t respond to a request for comment, but he won’t hold the gavel much longer with Sen. Maggie Hassan, D-N.H., in line to take over as chair in 2027.

Hassan and her counterpart on the House side, prospective Homeland Security Committee Chairman Bennie Thompson, D-Miss., both voiced concerns about Palantir’s work at the Department of Homeland Security and with its subagency, Immigration and Customs Enforcement.

“CISA plays a critical role in protecting our nation’s cybersecurity infrastructure, and the Trump-Vance administration has undermined CISA by cutting its funding, reducing agency staff, and making us vulnerable to cyberattacks from our adversaries,” Hassan said in a statement to CyberScoop. “I will carefully review Mr. LoSapio’s nomination to lead CISA, as I do with any nominee. But given his senior role at Palantir, which has provided tools that helped enable ICE’s lawless behavior under this administration, I have serious questions about whether he has the independence and judgement needed for this position.” 

Thompson expressed apprehensions for similar reasons.

“CISA is at a critical juncture, rebuilding after a year of reckless efforts to hack up the agency. I don’t know much about Mr. LoSapio, but certainly his relationship with Palantir raises very serious concerns given its role in DHS surveillance programs,” he said in a statement to CyberScoop. “I’m concerned that baggage will be an unnecessary distraction from the urgent rebuilding efforts at CISA. I urge my Senate colleagues to thoroughly vet Mr. LoSapio before proceeding with his nomination.”

The current top Democrat on the Senate panel, the retiring Gary Peters of Michigan, also cited the threats CISA is facing amid cutbacks: “Mr. LoSapio must demonstrate that he possesses the independent judgment and qualifications to decisively place national security and the national interest above political pressure.”

The current chairman of the House panel, Andrew Garbarino, R-N.Y., said he appreciated Trump putting forward a nominee given the need for a Senate-confirmed director, something CISA has lacked for his second term, even as he praised the leadership of acting director Nick Andersen.

“I look forward to reviewing the qualifications of Michael LoSapio and urge the Senate to do so with urgency,” he said in a statement.

Unlike another of the top cybersecurity officials in the Trump administration prior to his nomination, National Cyber Director Sean Cairncross, LoSapio comes with technical credentials.

A former Trump administration official said that LoSapio’s name was first floated months ago, and said his cybersecurity certifications and experience managing cyber risk for a major public company would make him a good fit for the role.

A cybersecurity executive who knows and has worked with LoSapio said he was an “exceptional choice” for the job.

“Mike LoSapio is an extremely competent and talented cybersecurity leader. He knows his stuff,” the executive said. “He defends one of the most targeted organizations on the planet” because of Palantir’s sensitive government work.

CISA is primarily a technical agency, so “that work is best done by someone who knows how to do it,” the executive said. LoSapio is also a “high-integrity” person who isn’t “dogmatic or political” or “the kind of person that would be cowed by political pressure.”

But his role at Palantir is drawing criticism, something the executive said he understood given concerns about surveillance in the United States, even as the executive noted LoSapio has proven capable of navigating those “thorny issues.”

Patrick Eddington, a senior fellow at the libertarian Cato Institute think tank, acknowledged LoSapio’s technical background but said his lack of a government background and no public record of weighing in on the subject matter CISA works on adds up to a “thin resume.” More worrisome, he said, is that CISA is a Palantir customer.

“The nominee would come from the vendor whose software is already being bought, without competition, by the office he’d run,” Eddington said. “And the agency responsible for judging the security of federal civilian systems would be led by the former security chief of a vendor whose platforms now run across DHS. That’s where ethics rules would normally help, yet this administration has weakened them.”

Before confirming LoSapio, senators should find out what kind of Palantir stock or other holdings LoSapio has and whether he’ll divest it, whether he’ll recuse himself from Palantir matters for longer than the Trump administration would require, whether he has made bargains to return to Palantir after CISA service and other answers about potential conflicts of interest.

“Bottom line: Palantir’s business is fusing government data at scale, and DHS has made it the default analytics vendor across the department,” Eddington said. “Putting the company’s security chief in charge of the agency that sets the security bar for those systems, with a one-year recusal as the main safeguard, risks making CISA one vendor’s customer, regulator and alumni network all at once. Even if LoSapio is entirely well-intentioned, that’s the wrong setup.”

A Palantir spokesperson didn’t respond to requests for comment.

Even in optimal circumstances for a nominee, it can take some time to work through the Senate confirmation process and then begin shaping an agency as its leader, said Joshua Corman, a former CISA adviser and now executive in residence for public safety and resilience at the Institute for Security and Technology.

Andersen and his team, even amid budget cutbacks, “never gave up” on the agency, Corman said, and set important priorities for “the most life-safety of our critical functions.”

With two years left in Trump’s term, “it may be hard to have much of a dent, no matter who gets the nod, and as such, I really hope they lean on the current steward” in Andersen, Corman said. 

Madison Alder contributed reporting to this story.

The post CISA director pick already drawing concern from Hill Dems over Palantir connection appeared first on CyberScoop.

Democrats’ big win on Election Day, which saw them take control of both the House and Senate, has ramifications for the Cybersecurity and Infrastructure Security Agency, artificial intelligence, surveillance policy and much more.

Here’s what lawmakers and cybersecurity experts have to say about the short-term and long-term prospects on Capitol Hill.

Leadership plans ahead

Maggie Hassan, D-N.H. is in line to take the gavel on the Senate Homeland Security and Governmental Affairs Committee, with Sen. Gary Peters, Mich., retiring.

“Our government’s number one job is to keep people safe, and the Senate Homeland Security and Governmental Affairs Committee must work to ensure that our country remains safe, secure and free from all kinds of threats,” Hassan said in a statement to CyberScoop. “That work involves protecting against terrorism and fentanyl trafficking, but it also includes guarding against emerging threats like artificial intelligence security risks and strengthening our cybersecurity.”

“The Trump-Vance administration has undermined our security on these fronts, including by diverting resources away from combatting fentanyl trafficking and gutting CISA,” she continued. “We need to reverse these cuts, confront these challenges and put public safety first.”

Rep. Bennie Thompson, D-Miss., is poised to return once again as chair of the House Homeland Security Committee, said Democrats are taking over at a “pivotal time for CISA,” with it looking to add staff after cutting back by nearly one-third.

“First and foremost, we will aim to work with CISA to expedite its critical re-staffing effort and to ensure it has the expertise necessary to support stakeholders as they defend against the scale and velocity of AI-enabled cyber-attacks,” he said in a statement to CyberScoop. “Advances in AI can help defenders, but it will also accelerate the consequences of deferred investments in security and CISA must be well-positioned to help critical infrastructure owners and operators rapidly improve their cybersecurity posture.”

“We will prioritize getting resources straight into the hands for defenders — by extending the State and Local Cybersecurity Grant Program and improving support of under-resourced sectors, especially water,” he continued. “We will work to ensure CISA re-establishes its cross-sector coordination capacity, which was diminished when the Trump administration- terminated CIPAC, by making sure the Anchor-CI is eventually up and running and meets the needs of stakeholders. Finally, we will make sure CISA is well-positioned to support the secure development and deployment of AI.”

What happens in the lame-duck session

Before the GOP relinquishes control of the House and Senate to Democrats, though, there’s a lame-duck session ahead. 

Long-term renewal of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) is a bipartisan and industry priority, with it set to expire Dec. 11. Current Senate Homeland Security and Governmental Affairs Chairman Rand Paul, R-Ky., has been the biggest obstacle to reauthorization, but he could get “rolled” by GOP leadership on an extension, said Michael Garcia, a former government cyber official and vice president of the cybersecurity practice at Monument Advocacy. Possible vehicles for CISA 2015 to hitch a ride include an omnibus funding bill or the annual defense policy bill.

The Department of Homeland Security, and its subagency CISA, are currently operating on a continuing resolution that’s also set to expire Dec. 11, where lawmakers could temporarily extend CISA 2015 if a long-term solution can’t be reached in the lame duck. Another continuing resolution before Dec. 11 in lieu of an omnibus spending bill is an option for the lame duck. Both a CR and omnibus spending bill would theoretically include DHS funding, although the agency’s funding has been made more difficult in the past by the presence of Immigration and Customs Enforcement within the department.

Republicans have talked about wanting to get the fiscal 2027 National Defense Authorization Act done in the lame duck. Besides the possibilities of CISA 2015 being included in the bill, Nicholas Leiserson, senior vice president for policy at the Institute for Security and Technology, said the Senate version of the legislation has a pair of very noteworthy cyber provisions: a “very broad” authorization for contractor-owned, contractor-operated offensive cyber operations, and a requirement that every artificial intelligence product sold to the Defense Department have an AI bill of materials.   

Additional leadership shuffle

While Paul is losing his gavel, he’s shown he can be a disruptive force on passing cybersecurity legislation through the Senate in the minority. That makes what he does next possibly determinative for cyber bills, Leiserson and Garcia said. “If he leaves HSGAC, let a thousand cyber bills flourish!” Garia quipped on social media. Paul could opt to become the top Republican on the Senate Health, Education, Labor and Pensions Committee instead of HSGAC.

Nebraska Sen. James Lankford would take over for Paul as top HSGAC Republican in that scenario, and an industry source said he’s viewed as a supporter of CISA 2015.

On Senate Intelligence, the panel’s leadership goes to a lawmaker who has placed a big emphasis on cybersecurity in his congressional career: Mark Warner, D-Va. 

On the House side, while Rep. Andrew Garbarino, R-N.Y., moves to the minority on the Homeland Security panel, he has proven willing to collaborate with Democrats on cybersecurity issues. Rep. Delia Ramirez, D-Ill., is poised to take the gavel of the panel’s cybersecurity subcommittee, and Rep. Vince Fong, R-of California looks set to become the subcommittee’s top Republican and has his own history of bipartisanship. Fong would replace current subcommittee chair Andy Ogles, the far-right Tennessee Republican who lost in the primaries.

One thing to watch in the House, Leiserson said, is how the House looks to tackle AI — through existing committees, a select committee or some other structure. Democrats haven’t put forward a unified front on AI guardrails yet.

With AI models uncovering as many vulnerabilities as they are, “highly capable frontier models are going to drive a lot of discussion” about AI and cybersecurity, said Craig Albright, the Business Software Alliance’s senior vice president for U.S. government relations.

Appropriations, oversight, legislation

If the NDAA or a CISA 2015 extension don’t pass in the lame duck, they’d be priorities in 2027, too.

“CISA 2015 has to happen, and if we can’t get it done, then we can’t move to the next thing,”  said Henry Young, BSA’s policy director. “Once we get it done, there’s an open question about which of these priorities that we’ve talked about gets to be number one. Is it post-quantum cryptography? Is it government IT modernization? Is it frontier AI cybersecurity systems? We don’t know that yet, and we can’t know until we pass this law.”

How damaged the agency CISA is by Trump administration’s budget cuts is something Democrats are expected to scrutinize closely. Another top budget issue is what to do with the expired State and Local Cybersecurity Grants Program housed at DHS, since even if it’s reauthorized, it will require appropriators taking steps to invest in it.

Democrats could take a look at a variety of other Trump administration changes at DHS and CISA, on topics like election security, the Cyber Safety Review Board, the Joint Cyber Defense Collaborative and more. 

More broadly, Leiserson said an area of Democratic cyber oversight is likely to be the Department of Government Efficiency that cut cyber personnel at agencies at and beyond CISA, and “particularly the integrity of systems that DOGE touched when they were given very high privileged access to federal systems.”

If the White House puts forward a permanent nominee for director of CISA, Democrats would be poised to vet that person. They also would have a say in who leads the Office of the National Cyber Director, should the incumbent, Sean Cairncross, depart.

So far, Democrats haven’t put forward a unified posture on expired surveillance authorities known as Section 702, although both Warner and incoming House Intelligence Chairman Jim Himes, D-Conn., have fought in the past for its renewal. The surveillance program is operating similarly still due to a court order, but that order only lasts through next spring.

The post What Democratic control of Congress means for cybersecurity appeared first on CyberScoop.

Seven out of 10 federal cyber regulations requiring written reports to federal agencies are duplicated elsewhere, a report from a government watchdog found in a report to Congress Wednesday.

And so far, efforts to de-conflict haven’t had much success, the report from the Government Accountability Office concluded.

At the request of two top lawmakers, the GAO examined federal cyber regulations at 37 agencies. It counted 80 out of 117 rules that “either contain the same kind of reporting requirement applicable to a sector or the same reporting requirement as at least one other regulation.”

The desire to harmonize those conflicting rules gathered steam under the Biden administration, as it undertook a more aggressive push to regulate cybersecurity than prior administrations. It has continued into the second Trump administration.

The GAO scrutinized regulations that required the private sector to report cybersecurity incidents, plans and reviews to federal agencies, as part of a study sought by House Homeland Security Chairman Andrew Garbarino, R-N.Y., and the top Democrat on the Senate counterpart to Garbarino’s panel, Gary Peters, D-Mich.

In some cases, a single critical infrastructure sector could have duplication with several agencies. For example, the Cybersecurity and Infrastructure Security Agency has been working on a regulation stemming from the 2022 Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), which would require critical infrastructure owners and operators to report when they are the victims of major attacks or make ransomware payments.

Elements of the financial services sector might fall under one of 15 preexisting cybersecurity reporting rules, depending on the agency that has oversight, but they may also be subject to the pending CIRCIA rules, GAO noted.

A 2024 national security memorandum tasked the Office of the National Cyber Director and the Department of Homeland Security to harmonize conflicting regulations, and both agencies made some progress on those goals.

But the executive branch paused some of those efforts after Trump issued an executive order in March of last year while the administration conducted a study of the 2024 memo, a study that was still underway as of last month, according to the GAO.

As such, on harmonization, “many past federal efforts have experienced delays and made limited progress,” the GAO concluded in its report Wednesday, its latest on the topic. 

Congress has also looked at ways to streamline cybersecurity regulations.

GAO’s study was focused only on federal rules. BreachRx, a cyber incident response firm, published its own report Wednesday looking at major cyber incidents and how overlapping regulatory reporting obligations came into play, folding in regulations from states and other sources.

The post Most federal cybersecurity reporting rules are duplicative, study finds appeared first on CyberScoop.