Leaked draft gives defense department equal footing with homeland security, but White House announces signing is cancelled without explanation on Tuesday

The Department of Homeland Security fears losing its primacy in civilian cybersecurity through an impending White House executive order, according to current and former officials, raising concerns about digital security in the Donald Trump era becoming a stalking horse for surveillance.



Trump had been expected on Tuesday afternoon to issue an executive order on cybersecurity, a long-forecast first venture into a subject central to rising public, security and international anxieties after mass hacks of big companies and the US government itself. But the White House abruptly told pool reporters that the signing was cancelled without explanation.

Draft versions of the order that have leaked have elevated the Pentagon to a co-equal role with DHS over cybersecurity, which would give the military, with its capabilities and interests in surveillance, a deeper role into civilian digital protection than ever before.

Officials suggested the order would be significantly different from the draft. But as of Monday night, senior DHS officials had yet to see a finalized order, the Guardian has learned, though drafts have circulated within the department.

But some internal sources said the cybersecurity decision-making process, though opaque to them, looks relatively sober compared to the mass turmoil resulting from Trump’s Friday immigration halt, which has roiled the department, aroused international fury at the White House and on Monday resulted in the late-night firing of the acting attorney general for her unwillingness to defend the order in court.

Paul Ryan urges Republicans to back travel ban despite anger over its rollout Read more

Some across the administration – none of whom would speak for the record or for the identification of their agencies, for fear of reprisal – believe the recent orders are moving the mammoth homeland security department, reluctantly created by George W Bush after the 9/11 attacks, into an immigration enforcement agency with vestigial roles in counterterrorism, cybersecurity and natural disaster response.

Others consider that fear overblown. They believe Trump is focusing the department first on central campaign promises – an immigration crackdown and a de facto Muslim ban – though not at permanent expense of the department’s other responsibilities.

But both camps attributed the confusion to a policymaking process directed by the White House and left to the cabinet departments to belatedly implement.



“None of these executive orders have been the product of an interagency process,” said a senior administration official.

Some DHS officials think private companies would prefer to deal with them rather than the military.

“Cybersecurity is about more than attacks and nation-states,” said Denelle Dixon, the chief lawyer for the Mozilla Foundation.

A former senior DHS official said the department’s apparent downgrading would lead to surveillance fears among companies concerned with customer privacy, as well as interrupting relationships built by the department’s undersecretary, Suzanne Spaulding; the deputy undersecretary, Phyllis Schneck; and the assistant secretary for cybersecurity, Andy Ozment, with Silicon Valley firms in the years after the disclosures of Edward Snowden.

“Those aren’t easy things to replicate, and those companies aren’t equipped to deal with the demand from the Pentagon,” the ex-official said.

Trump was scheduled to meet Tuesday with Rudy Giuliani, the former New York City mayor who has thrown his political lot in with the president and whom, on 12 January, Trump unveiled as an informal cybersecurity adviser. Various cybersecurity experts were also slated to discuss the issue with Trump on Tuesday afternoon.

According to a White House official, the order will instruct agency heads to be accountable for their data defenses, with the White House Office of Management and Budget in charge of assessing overall federal vulnerability.

A draft version of the order raised some alarms within DHS and former staff for placing the secretary of defense and the still-unconfirmed director of national intelligence as “co-chairs” of various expected reviews on cybersecurity alongside John Kelly, the new homeland security secretary.

Of particular concern is a “capabilities review” the draft report orders, to identify “an initial set of capabilities needing improvement to adequately protect US critical infrastructure”. Defense secretary Jim Mattis will chair that review, along with Kelly and Adm Mike Rogers, the commander of the surveillance-oriented NSA and its young military twin, US Cyber Command.

During the Obama administration, when cybersecurity was elevated as a concern, DHS was tasked with protecting civilian government data networks and liaising with the private sector, including vulnerable companies. Cyber Command was charged with defending military networks and attacking adversaries.

The NSA, whose tremendous cryptographic capabilities and technical expertise made it the incubator for Cyber Command, has been the elephant in the room, particularly after Snowden’s disclosures of mass surveillance alarmed tech giants. Legislative efforts to mandate private sector data-sharing with the government, routed through DHS, attracted a significant backlash over the degree of access the NSA would have to data it would otherwise have to acquire with a warrant.

An animating impulse behind the executive order is the escalating scale of data hacks that seem to surpass the current institutional structures for preventing or mitigating them.

A White House official did not respond to a request for comment about the future of DHS within the new cybersecurity structure.



Dixon, the chief legal and business officer of the Mozilla Foundation, said it was difficult to evaluate Trump’s cybersecurity policy before its development and looked forward to indications that the subject “will be a priority” for the new administration.

“However, we are concerned with a shift in responsibility for cybersecurity from a civilian agency to the Department of Defense. We’ve talked about how protecting cybersecurity is a shared responsibility and we believe that now more than ever. There is a need for governments, tech companies and users to work together on encryption, fixing security vulnerabilities and responsible surveillance,” Dixon told the Guardian.

“Encryption, secure communications, government surveillance, lawful hacking and even online privacy and data protection, at the end of the day, are fundamentally about securing data and protecting users. It’s about the importance and challenges of the day to day necessities of making systems secure and trustworthy for the internet as a global public resource.”