Democrats’ big win on Election Day, which saw them take control of both the House and Senate, has ramifications for the Cybersecurity and Infrastructure Security Agency, artificial intelligence, surveillance policy and much more.
Here’s what lawmakers and cybersecurity experts have to say about the short-term and long-term prospects on Capitol Hill.
Maggie Hassan, D-N.H. is in line to take the gavel on the Senate Homeland Security and Governmental Affairs Committee, with Sen. Gary Peters, Mich., retiring.
“Our government’s number one job is to keep people safe, and the Senate Homeland Security and Governmental Affairs Committee must work to ensure that our country remains safe, secure and free from all kinds of threats,” Hassan said in a statement to CyberScoop. “That work involves protecting against terrorism and fentanyl trafficking, but it also includes guarding against emerging threats like artificial intelligence security risks and strengthening our cybersecurity.”
“The Trump-Vance administration has undermined our security on these fronts, including by diverting resources away from combatting fentanyl trafficking and gutting CISA,” she continued. “We need to reverse these cuts, confront these challenges and put public safety first.”
Rep. Bennie Thompson, D-Miss., is poised to return once again as chair of the House Homeland Security Committee, said Democrats are taking over at a “pivotal time for CISA,” with it looking to add staff after cutting back by nearly one-third.
“First and foremost, we will aim to work with CISA to expedite its critical re-staffing effort and to ensure it has the expertise necessary to support stakeholders as they defend against the scale and velocity of AI-enabled cyber-attacks,” he said in a statement to CyberScoop. “Advances in AI can help defenders, but it will also accelerate the consequences of deferred investments in security and CISA must be well-positioned to help critical infrastructure owners and operators rapidly improve their cybersecurity posture.”
“We will prioritize getting resources straight into the hands for defenders — by extending the State and Local Cybersecurity Grant Program and improving support of under-resourced sectors, especially water,” he continued. “We will work to ensure CISA re-establishes its cross-sector coordination capacity, which was diminished when the Trump administration- terminated CIPAC, by making sure the Anchor-CI is eventually up and running and meets the needs of stakeholders. Finally, we will make sure CISA is well-positioned to support the secure development and deployment of AI.”
Before the GOP relinquishes control of the House and Senate to Democrats, though, there’s a lame-duck session ahead.
Long-term renewal of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) is a bipartisan and industry priority, with it set to expire Dec. 11. Current Senate Homeland Security and Governmental Affairs Chairman Rand Paul, R-Ky., has been the biggest obstacle to reauthorization, but he could get “rolled” by GOP leadership on an extension, said Michael Garcia, a former government cyber official and vice president of the cybersecurity practice at Monument Advocacy. Possible vehicles for CISA 2015 to hitch a ride include an omnibus funding bill or the annual defense policy bill.
The Department of Homeland Security, and its subagency CISA, are currently operating on a continuing resolution that’s also set to expire Dec. 11, where lawmakers could temporarily extend CISA 2015 if a long-term solution can’t be reached in the lame duck. Another continuing resolution before Dec. 11 in lieu of an omnibus spending bill is an option for the lame duck. Both a CR and omnibus spending bill would theoretically include DHS funding, although the agency’s funding has been made more difficult in the past by the presence of Immigration and Customs Enforcement within the department.
Republicans have talked about wanting to get the fiscal 2027 National Defense Authorization Act done in the lame duck. Besides the possibilities of CISA 2015 being included in the bill, Nicholas Leiserson, senior vice president for policy at the Institute for Security and Technology, said the Senate version of the legislation has a pair of very noteworthy cyber provisions: a “very broad” authorization for contractor-owned, contractor-operated offensive cyber operations, and a requirement that every artificial intelligence product sold to the Defense Department have an AI bill of materials.
While Paul is losing his gavel, he’s shown he can be a disruptive force on passing cybersecurity legislation through the Senate in the minority. That makes what he does next possibly determinative for cyber bills, Leiserson and Garcia said. “If he leaves HSGAC, let a thousand cyber bills flourish!” Garia quipped on social media. Paul could opt to become the top Republican on the Senate Health, Education, Labor and Pensions Committee instead of HSGAC.
Nebraska Sen. James Lankford would take over for Paul as top HSGAC Republican in that scenario, and an industry source said he’s viewed as a supporter of CISA 2015.
On Senate Intelligence, the panel’s leadership goes to a lawmaker who has placed a big emphasis on cybersecurity in his congressional career: Mark Warner, D-Va.
On the House side, while Rep. Andrew Garbarino, R-N.Y., moves to the minority on the Homeland Security panel, he has proven willing to collaborate with Democrats on cybersecurity issues. Rep. Delia Ramirez, D-Ill., is poised to take the gavel of the panel’s cybersecurity subcommittee, and Rep. Vince Fong, R-of California looks set to become the subcommittee’s top Republican and has his own history of bipartisanship. Fong would replace current subcommittee chair Andy Ogles, the far-right Tennessee Republican who lost in the primaries.
One thing to watch in the House, Leiserson said, is how the House looks to tackle AI — through existing committees, a select committee or some other structure. Democrats haven’t put forward a unified front on AI guardrails yet.
With AI models uncovering as many vulnerabilities as they are, “highly capable frontier models are going to drive a lot of discussion” about AI and cybersecurity, said Craig Albright, the Business Software Alliance’s senior vice president for U.S. government relations.
If the NDAA or a CISA 2015 extension don’t pass in the lame duck, they’d be priorities in 2027, too.
“CISA 2015 has to happen, and if we can’t get it done, then we can’t move to the next thing,” said Henry Young, BSA’s policy director. “Once we get it done, there’s an open question about which of these priorities that we’ve talked about gets to be number one. Is it post-quantum cryptography? Is it government IT modernization? Is it frontier AI cybersecurity systems? We don’t know that yet, and we can’t know until we pass this law.”
How damaged the agency CISA is by Trump administration’s budget cuts is something Democrats are expected to scrutinize closely. Another top budget issue is what to do with the expired State and Local Cybersecurity Grants Program housed at DHS, since even if it’s reauthorized, it will require appropriators taking steps to invest in it.
Democrats could take a look at a variety of other Trump administration changes at DHS and CISA, on topics like election security, the Cyber Safety Review Board, the Joint Cyber Defense Collaborative and more.
More broadly, Leiserson said an area of Democratic cyber oversight is likely to be the Department of Government Efficiency that cut cyber personnel at agencies at and beyond CISA, and “particularly the integrity of systems that DOGE touched when they were given very high privileged access to federal systems.”
If the White House puts forward a permanent nominee for director of CISA, Democrats would be poised to vet that person. They also would have a say in who leads the Office of the National Cyber Director, should the incumbent, Sean Cairncross, depart.
So far, Democrats haven’t put forward a unified posture on expired surveillance authorities known as Section 702, although both Warner and incoming House Intelligence Chairman Jim Himes, D-Conn., have fought in the past for its renewal. The surveillance program is operating similarly still due to a court order, but that order only lasts through next spring.
The post What Democratic control of Congress means for cybersecurity appeared first on CyberScoop.
The Trump administration is breaking the law after being more than a month overdue on declassifying a court opinion on the surveillance of U.S. citizens, according to two senators and a coalition of civil liberties groups.
Release of the Foreign Intelligence Surveillance Court (FISC) opinion has been closely tied to reauthorizing Section 702 of the Foreign Intelligence Surveillance Act (FISA), which lapsed this summer, although collection authority has continued under another court ruling that runs through March of next year.
Under Section 702, the government can warrantlessly search foreign targets’ electronic and phone communications using the personal information of Americans who have been in contact with them.
In the FISC opinion that the administration has not declassified, a judge objected to tools the government has created to let analysts process messages. The objection reportedly was over a filtering system that allowed analysts to get information in a way that should be counted as a query of Americans’ information, which is subject to extra protections.
Sen. Ron Wyden, D-Ore., who co-authored a letter to administration officials Monday with Sen. Adam Schiff, D-Calif., had previously said the opinion shows “major compliance problems” and had objected to a short-term reauthorization of Section 702 until officials agreed to release it.
“As Congress continues to debate the fate of this authority, lawmakers must be able to discuss these abuses openly,” Wyden and Schiff wrote to Director of National Intelligence Jay Clayton and Attorney General Todd Blanche. “Otherwise, the American people will rightly question whether a government that so flagrantly violates basic legal requirements, like the statute requiring declassification, can ever be trusted to not abuse a powerful surveillance tool like Section 702.”
The Senate duo and the coalition of civil liberties groups in a separate letter to congressional leaders said that under the law, the letter was due Sept. 13. Blanche had previously committed to declassify the letter to lawmakers by the statutory deadline. The letter was also overdue by another measurement, with the leaders of the Senate Intelligence Committee saying that they expected the declassification and release by May 15.
A spokesperson for Senate Intelligence Chairman Tom Cotton, R-Ark., didn’t respond to a request for comment, but the office of the leader of the Democratic side of the panel, Sen. Mark Warner of Virginia, did.
“The Vice Chairman has been clear that he supports transparency with regard to Section 702 of FISA,” a spokesperson, Rachel Cohen, said in a statement to CyberScoop. “This is precisely why he and Chairman Cotton urged then-DNI [Tulsi] Gabbard in March to declassify the March 17 FISC opinion. Unfortunately, neither Director Gabbard nor Acting Director [Bill] Pulte were responsive, but Senator Warner expects that DNI Clayton will declassify the opinion, consistent with the bipartisan SSCI letter and as required by law.”
Failure to declassify the opinion should be fatal to reauthorizing the expired surveillance law, the civil liberties groups wrote.
“Congress should refuse to support any reauthorization of Section 702 while the administration actively withholds legally mandated information about how the surveillance program operates,” they wrote. “Further, it must stop relying on executive branch self-policing to protect Americans’ rights and reauthorize Section 702 only with a warrant requirement to access Americans’ private communications.”
The Office of the Director of National Intelligence and the Justice Department didn’t immediately respond to requests for comment.
The post Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion appeared first on CyberScoop.
A bipartisan update to a California wiretapping law will eliminate the right to sue over internet-based surveillance, ending a key provision of a 57-year-old wiretapping law. Advocates say it is an overdue correction meant to prevent frivolous lawsuits, while privacy advocates call it a blow to digital consumer privacy rights.
The California Invasion of Privacy Act, originally passed in 1967, requires a court order for wiretapping, eavesdropping, interception or recording of telephone calls. Over time, courts extended the law to cover most internet-based communications as well, such as email and websites.
In 2015, lawmakers added a provision allowing residents to sue companies for unauthorized use of certain internet-tracking technologies, such as pen registers, with penalties up to $5,000 per violation, plus triple damages. Last week, Calif. Gov. Gavin Newsom signed SB 690 into law, that removes the right of private citizens to sue websites and mobile applications through CIPA.
Newsom and sponsors of the law say the provision has spawned thousands of lawsuits and demand letters against companies for using common internet-tracking tools, like browser cookies and tracker pixels, that can serve legitimate business purposes.
Pen registers and trap-and-trace devices are primarily used by law enforcement agencies—such as local police, the FBI, and the DEA—as well as national security organizations during active criminal and counterintelligence investigations. Authorized through a court order, investigators use pen registers to log outgoing metadata like dialed phone numbers, IP addresses, and timestamps (and trap-and-trace tools for incoming contacts) to map out a suspect’s communication network without listening to the content of the conversations.
“This measure addresses the vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses that unwittingly install software on their websites that at times have tracked and shared the information of visitors to the site,” Newsom wrote in his signing statement. “I applaud the authors’ efforts and align myself with the goal of protecting small businesses from overzealous lawsuits based on a statute written without today’s complex technology landscape in mind.”
According to privacy attorneys at law firm Kelley Drye, the addition of the pen register and trap-and-trace statute in 2015 was meant to codify how law enforcement agencies could obtain court orders for phone metadata without violating CIPA.
Estimates of lawsuits filed under the provision vary widely. The law was widely supported by business groups like the Chamber of Commerce, which was one of hundreds of California groups that signed in support of the legislation last year.
The Alliance for Legal Fairness, a Virginia-based lobbying firm backing the legislative update, tracked approximately 600 lawsuits under the provision in 2025, according to written comments. Today, the group claims that number has “exploded” to more than 4,000.
According to Shruti Bhutani Arora and Christine Mastromonaco, privacy attorneys for the law firm Pillsbury, plaintiffs and prospective litigants have “sent tens of thousands of demand letters to businesses threatening class-action suits under the CIPA’s pen-register and trap-and-trace provisions for using everyday website tools like cookies, analytics software and pixels.”
A report from the California Assembly Committee on Privacy and Consumer Protection characterized the pen register provision as “the poster child for abusive lawsuits.”
“Enterprising plaintiffs’ attorneys have exploited the statute at scale to go after businesses using third-party software to enable advertising on their websites,” the committee wrote. “Because the potential liability can be staggering, businesses generally settle this litigation hastily, encouraging vexatious litigants to continue blasting out demand letters.”
Meanwhile, most major California labor unions opposed the law, as did the American Civil Liberties Union, the Consumer Federation of California, the Privacy Rights Clearinghouse, the Electronic Privacy Information Center and dozens of civil rights groups.
The committee report also noted opposition by “a broad array of privacy, civil society, legal and immigrant rights organizations.”
The Electronic Frontier Foundation in particular has fought the bill for years. Early versions of SB 690 would have exempted other privacy provisions from private lawsuits, but later versions narrowed the exemption to just pen registers and trap-and-trace devices.
Privacy groups argue the exemption will make it easier for companies to track, collect and sell consumer data to third parties, including data brokers, while making it harder for individuals to take legal action.
Hayley Tsukayama, director of state affairs at EFF, told CyberScoop that the bill “never should have been signed” and that the organization tried and failed to lobby Newsom to veto it.
“CIPA was originally intended to protect personal privacy against the threat of surveillance of private communications,” said Tsukayama in a statement. “But this ‘reform’ harms privacy by making it impossible for ordinary people to sue companies engaged in unlawful metadata surveillance. That’s especially scary as the federal government and other law enforcement agencies seek data from businesses or data brokers to target people based on their political beliefs, religious affiliations, or health decisions.”
California passed major privacy legislation in 2018, standing up the California Privacy Protection Agency to enforce digital privacy laws. It has some of the strictest data broker laws in the nation, requiring brokers to register with the government and provide consumers with easy, universal opt-out options for data collection.
The post Wiretapping change sparks big privacy fight in the Golden State appeared first on CyberScoop.
Login