Disbanding of DHS Cyber Safety Review Board a 'Gift' to China

On January 20, 2025, the Trump Administration issued a sweeping directive to terminate all memberships of advisory committees reporting to the U.S. Department of Homeland Security (DHS). Among the disbanded bodies was the Cyber Safety Review Board (CSRB), a public-private initiative established in 2022 to assess significant cybersecurity events and provide actionable recommendations.

The decision has sparked widespread concern across the cybersecurity community, particularly given the CSRB's track record and its ongoing investigation into the Salt Typhoon cyberattacks targeting U.S. telecom providers.

The CSRB's accomplishments

The CSRB has been at the forefront of cybersecurity incident analysis, delivering critical insights and recommendations that have informed both public and private sector practices. Key achievements include:

• Log4j vulnerabilities (2022): The CSRB's inaugural report tackled the Log4Shell vulnerability in the Apache Log4j library, identifying it as an endemic weakness that organizations will face for years. The board's recommendations on mitigation strategies were widely praised for their clarity and depth.

• Microsoft Storm-0558 breach (2023): Following a cascade of errors by Microsoft that enabled China-based hackers to breach dozens of organizations, the CSRB issued a scathing report. It called for improved transparency and accountability from technology providers, and emphasized the need for robust supply chain security measures.

• LAPSUS$ cybercrime group analysis (2023): The board's investigation into the LAPSUS$ hacking group highlighted its innovative and aggressive tactics. The report provided actionable guidance to bolster defenses against similar cybercriminal activities.

The Salt Typhoon investigation: a critical loss

At the time of its disbandment, the CSRB was actively investigating a wave of cyberattacks attributed to the Chinese state-sponsored group Salt Typhoon. These attacks have targeted U.S. telecommunications infrastructure, compromising critical systems and threatening national security. The CSRB's work was poised to provide valuable insights into the attackers' methods and offer strategies for mitigating future threats.

Cedric Leighton, Retired U.S. Air Force Colonel and CNN Military Analyst, spoke with SecureWorld News and expressed grave concern over the implications of disbanding the CSRB, saying:

"China is engaged in a massive cyber campaign against our critical infrastructure. China's Salt Typhoon and Volt Typhoon campaigns have targeted our commercial and military infrastructures in a very sophisticated way. The new Administration's apparent failure to appreciate the magnitude and implications of China's cyber espionage campaign shows a fundamental misunderstanding of the current threat environment the U.S. is facing. This could lead to a colossal exfiltration of data and dire consequences should hostilities begin between China and the U.S."

Broader implications

The disbanding of the CSRB comes at a time of escalating cyber threats from state-sponsored actors, particularly China. Critics argue that eliminating a body focused on incident response and systemic analysis undermines national cybersecurity. U.S. Senator Ron Wyden shared his thoughts on BlueSky:

Col. Leighton echoed these concerns, stating, "If this is a 'quid pro quo', as Sen. Wyden alleges, in exchange for a corporate contribution to the President's inauguration, then it shows that we're in for a period of lax cybersecurity standards which we will pay dearly for. Many big corporations, including Microsoft, have a history of not baking security into their products. The resulting vulnerabilities would often be avoidable if we put security first as software is developed."

Beyond the CSRB, other advisory boards focusing on artificial intelligence, critical infrastructure, and telecommunications were also disbanded. The Trump Administration justified the move as an effort to eliminate "misuse of resources," but critics have pointed out that these advisory roles were voluntary and unpaid, challenging the rationale.

What's next?

With the CSRB's work abruptly halted, the question remains: How will DHS fill the void left by the board's dissolution? Acting DHS Secretary Benjamine C. Huffman stated that future committee activities would focus on advancing "our critical mission to protect the homeland." However, the lack of a clear plan to replace or restructure the CSRB raises concerns about the nation's preparedness for future cyber incidents.

"Disbanding the CSRB is precisely the wrong thing to do if you're truly focused on 'protecting the homeland'," said Col. Leighton. "Dismantling cyber protections, especially when they have proven to be effective, is frankly irresponsible when some of the most potent threats to our nation take the form of cyber attacks."

A call to action

The CSRB's dissolution highlights the need for bipartisan efforts to ensure continuity in cybersecurity oversight and incident response. Public-private collaboration has proven essential in addressing complex threats, and the loss of the CSRB risks leaving critical gaps in the U.S. cybersecurity ecosystem.

"Disbanding the CSRB is a case of 'throwing the baby out with the bathwater'," Col. Leighton added. "Government efficiency and accountability are laudable goals, but you don't get there if you eliminate the parts of government that actually work—like the CSRB."

As cyber threats continue to evolve, the cybersecurity community must advocate for restoring or reimagining mechanisms like the Cyber Safety Review Board to safeguard the nation's digital infrastructure. The stakes are simply too high to leave this work unfinished.

Follow SecureWorld News for more stories related to cybersecurity.