Democrats’ big win on Election Day, which saw them take control of both the House and Senate, has ramifications for the Cybersecurity and Infrastructure Security Agency, artificial intelligence, surveillance policy and much more.

Here’s what lawmakers and cybersecurity experts have to say about the short-term and long-term prospects on Capitol Hill.

Leadership plans ahead

Maggie Hassan, D-N.H. is in line to take the gavel on the Senate Homeland Security and Governmental Affairs Committee, with Sen. Gary Peters, Mich., retiring.

“Our government’s number one job is to keep people safe, and the Senate Homeland Security and Governmental Affairs Committee must work to ensure that our country remains safe, secure and free from all kinds of threats,” Hassan said in a statement to CyberScoop. “That work involves protecting against terrorism and fentanyl trafficking, but it also includes guarding against emerging threats like artificial intelligence security risks and strengthening our cybersecurity.”

“The Trump-Vance administration has undermined our security on these fronts, including by diverting resources away from combatting fentanyl trafficking and gutting CISA,” she continued. “We need to reverse these cuts, confront these challenges and put public safety first.”

Rep. Bennie Thompson, D-Miss., is poised to return once again as chair of the House Homeland Security Committee, said Democrats are taking over at a “pivotal time for CISA,” with it looking to add staff after cutting back by nearly one-third.

“First and foremost, we will aim to work with CISA to expedite its critical re-staffing effort and to ensure it has the expertise necessary to support stakeholders as they defend against the scale and velocity of AI-enabled cyber-attacks,” he said in a statement to CyberScoop. “Advances in AI can help defenders, but it will also accelerate the consequences of deferred investments in security and CISA must be well-positioned to help critical infrastructure owners and operators rapidly improve their cybersecurity posture.”

“We will prioritize getting resources straight into the hands for defenders — by extending the State and Local Cybersecurity Grant Program and improving support of under-resourced sectors, especially water,” he continued. “We will work to ensure CISA re-establishes its cross-sector coordination capacity, which was diminished when the Trump administration- terminated CIPAC, by making sure the Anchor-CI is eventually up and running and meets the needs of stakeholders. Finally, we will make sure CISA is well-positioned to support the secure development and deployment of AI.”

What happens in the lame-duck session

Before the GOP relinquishes control of the House and Senate to Democrats, though, there’s a lame-duck session ahead. 

Long-term renewal of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) is a bipartisan and industry priority, with it set to expire Dec. 11. Current Senate Homeland Security and Governmental Affairs Chairman Rand Paul, R-Ky., has been the biggest obstacle to reauthorization, but he could get “rolled” by GOP leadership on an extension, said Michael Garcia, a former government cyber official and vice president of the cybersecurity practice at Monument Advocacy. Possible vehicles for CISA 2015 to hitch a ride include an omnibus funding bill or the annual defense policy bill.

The Department of Homeland Security, and its subagency CISA, are currently operating on a continuing resolution that’s also set to expire Dec. 11, where lawmakers could temporarily extend CISA 2015 if a long-term solution can’t be reached in the lame duck. Another continuing resolution before Dec. 11 in lieu of an omnibus spending bill is an option for the lame duck. Both a CR and omnibus spending bill would theoretically include DHS funding, although the agency’s funding has been made more difficult in the past by the presence of Immigration and Customs Enforcement within the department.

Republicans have talked about wanting to get the fiscal 2027 National Defense Authorization Act done in the lame duck. Besides the possibilities of CISA 2015 being included in the bill, Nicholas Leiserson, senior vice president for policy at the Institute for Security and Technology, said the Senate version of the legislation has a pair of very noteworthy cyber provisions: a “very broad” authorization for contractor-owned, contractor-operated offensive cyber operations, and a requirement that every artificial intelligence product sold to the Defense Department have an AI bill of materials.   

Additional leadership shuffle

While Paul is losing his gavel, he’s shown he can be a disruptive force on passing cybersecurity legislation through the Senate in the minority. That makes what he does next possibly determinative for cyber bills, Leiserson and Garcia said. “If he leaves HSGAC, let a thousand cyber bills flourish!” Garia quipped on social media. Paul could opt to become the top Republican on the Senate Health, Education, Labor and Pensions Committee instead of HSGAC.

Nebraska Sen. James Lankford would take over for Paul as top HSGAC Republican in that scenario, and an industry source said he’s viewed as a supporter of CISA 2015.

On Senate Intelligence, the panel’s leadership goes to a lawmaker who has placed a big emphasis on cybersecurity in his congressional career: Mark Warner, D-Va. 

On the House side, while Rep. Andrew Garbarino, R-N.Y., moves to the minority on the Homeland Security panel, he has proven willing to collaborate with Democrats on cybersecurity issues. Rep. Delia Ramirez, D-Ill., is poised to take the gavel of the panel’s cybersecurity subcommittee, and Rep. Vince Fong, R-of California looks set to become the subcommittee’s top Republican and has his own history of bipartisanship. Fong would replace current subcommittee chair Andy Ogles, the far-right Tennessee Republican who lost in the primaries.

One thing to watch in the House, Leiserson said, is how the House looks to tackle AI — through existing committees, a select committee or some other structure. Democrats haven’t put forward a unified front on AI guardrails yet.

With AI models uncovering as many vulnerabilities as they are, “highly capable frontier models are going to drive a lot of discussion” about AI and cybersecurity, said Craig Albright, the Business Software Alliance’s senior vice president for U.S. government relations.

Appropriations, oversight, legislation

If the NDAA or a CISA 2015 extension don’t pass in the lame duck, they’d be priorities in 2027, too.

“CISA 2015 has to happen, and if we can’t get it done, then we can’t move to the next thing,”  said Henry Young, BSA’s policy director. “Once we get it done, there’s an open question about which of these priorities that we’ve talked about gets to be number one. Is it post-quantum cryptography? Is it government IT modernization? Is it frontier AI cybersecurity systems? We don’t know that yet, and we can’t know until we pass this law.”

How damaged the agency CISA is by Trump administration’s budget cuts is something Democrats are expected to scrutinize closely. Another top budget issue is what to do with the expired State and Local Cybersecurity Grants Program housed at DHS, since even if it’s reauthorized, it will require appropriators taking steps to invest in it.

Democrats could take a look at a variety of other Trump administration changes at DHS and CISA, on topics like election security, the Cyber Safety Review Board, the Joint Cyber Defense Collaborative and more. 

More broadly, Leiserson said an area of Democratic cyber oversight is likely to be the Department of Government Efficiency that cut cyber personnel at agencies at and beyond CISA, and “particularly the integrity of systems that DOGE touched when they were given very high privileged access to federal systems.”

If the White House puts forward a permanent nominee for director of CISA, Democrats would be poised to vet that person. They also would have a say in who leads the Office of the National Cyber Director, should the incumbent, Sean Cairncross, depart.

So far, Democrats haven’t put forward a unified posture on expired surveillance authorities known as Section 702, although both Warner and incoming House Intelligence Chairman Jim Himes, D-Conn., have fought in the past for its renewal. The surveillance program is operating similarly still due to a court order, but that order only lasts through next spring.

The post What Democratic control of Congress means for cybersecurity appeared first on CyberScoop.

A coalition of cyber firms and critical infrastructure operators on Tuesday spelled out its views on the tasks that the Cybersecurity and Infrastructure Security Agency should assign federal agencies to protect operational technology systems after this summer’s attacks on water utilities.

The Operational Technology Cybersecurity Coalition said a CISA binding operational directive (BOD) for OT should specify who is responsible for protecting these systems at each agency,, draw on existing federal guidelines and set minimum cybersecurity practices.

The coalition said the BOD would address a need to act based on CISA’s lack of visibility into the spectrum of OT devices in federal agencies, a lack of consistent across-the-board OT security policies and the severity of the consequences that an attack on federal OT could produce.

Just last month, the Government Accountability Office published a report which concluded that most federal civilian executive branch agencies (FCEBs) haven’t enacted Office of Management and Budget requirements released in 2023 for networked Internet of Things and OT devices.

Putting forward recommendations for a CISA directive has two goals, said Michael Garcia, policy director of the coalition.

“One, it does make sure that the government is taking its own medicine,” said Garcia, who until recently worked at the agency. “You should practice what you preach. … Second, it sends a very strong signal to the private sector that, ‘This is what we think is important: As an OT partner, owner or operator or critical infrastructure owner or operator, [this is what] you should ask other providers to do.’”

There are 8,000 General Services Administration-owned and -leased properties, many of which would have OT involved in everything from power supply to heating, ventilation and air conditioning systems. Some of those OT systems might be “trivial,” Garcia acknowledged, but the coalition paper notes that CISA “does not currently have a holistic view of the assets managed by the FCEB and the potential risks, such as connected programmable logic controllers, to which the government may be exposed.”

With OT falling into a “government gray zone” between chief information officers and facilities managers, CISA should tell agencies to formally designate an officer in charge of cybersecurity for OT, the coalition recommends.

The directive should examine past OT guidelines the National Security Agency issued to see if they should apply to federal civilian agencies, and align any requirements in the hypothetical BOD with cybersecurity performance goals that CISA first issued in 2022, according to the coalition.

The coalition doesn’t assert that such a BOD would have headed off the attacks this summer on the water sector, and is focused on federal OT, something where CISA has done some work.

“To be fair, CISA has incorporated OT security requirements into prior directives (such as BODs 23-01, 23-02, and 26-04) alongside a host of technical guidance,” the paper reads. “But as AI reduces the technical barriers to sophisticated cyber operations, enabling adversaries to identify weaknesses, accelerate reconnaissance, and move laterally through poorly segmented operational environments with greater speed and scale, it is time for an encompassing BOD solely focused on OT security.”

CISA didn’t respond to a request for comment Monday in advance of the coalition publishing its paper.

But Garcia said that in discussions with CISA, “increasingly, I think they understand that there might be a need” for an OT BOD.

The post Here’s how experts think CISA should tell agencies to protect OT appeared first on CyberScoop.