A new agency to investigate cyberattacks

Tom Brady

Connect With Us

When you make purchases through our links we may earn a small commission.

Organizations that fall victim to hacks often keep tight-lipped about what happened due to fear of legal liability or brand damage. But cybersecurity experts have long warned that the country will never break free from an endless cycle of computer breaches unless companies and government agencies become more transparent about how they got infiltrated. The danger was underscored in 2020 when a sophisticated Russian hack breached nine federal agencies.

🇺🇸 Support us on Patreon for only $1.99 a month 🇺🇸
🍻 Join us on Facebook @TheSmokingChair 🍻

The move

In 2021, Biden stood up the Cyber Safety Review Board, a government review panel charged with investigating the most significant computer security breaches that have affected the country. Just as the National Transportation Safety Board investigates transportation incidents, the new DHS-led panel is tasked with identifying the root cause of significant hacks and offering guidance to ensure they never happen again. The Board has 15 members hailing from both the private sector and the U.S. government.

Content Continues Below

The impact

The CSRB has received strong positive feedback from the cybersecurity industry for its first two investigations: one into a software vulnerability that had the government bracing for digital crisis and a second involving a group of hackers who developed a playbook to slip the defenses at some of the country’s highest profile companies, among them Uber and Microsoft. It’s unclear how much impact the board has really had, however, given that companies are not obligated to follow its guidance. It has also received criticism for appearing to avoid investigations that could make individual companies or the government look bad — a charge the CSRB denies.

The upshot

The Biden administration is hoping Congress will make the CSRB a permanent fixture of the federal government’s cybersecurity landscape. It has sent lawmakers draft legislation to codify the panel into law, enhance its budget and give it greater legal authorities to compel the production of evidence from breach victims. But Congress hasn’t yet acted, leaving the future of the board an open question.