Evidence of a shakeup of cybersecurity authorities at the State Department has some concerned about the future of the U.S. government’s international engagement on internet security and policy.
The department’s cybersecurity coordinator, Chris Painter, will leave his position at the end of July after more than six years on the job, potentially leaving a void at the highest level of the government’s efforts to promote U.S. cybersecurity interests abroad.
{mosads}State is said to be planning to close the office that Painter headed, moving its responsibilities under a bureau charged with engaging with foreign partners on economic issues.
Meanwhile, the department faces severe challenges in cyber going forward, including an upcoming United Nations meeting in September and a deadline for submitting a strategy for international engagement on cybersecurity to the White House.
“Chris did a great job at getting this on the international agenda, of making it a senior-level issue in governments around the world. Now the challenge is to get people to think about how to make security better,” said James Lewis, senior vice president at the Center for Strategic and International Studies.
“I think there’s going to be a gap in leadership. I think that’s inevitable. The question is, how can we limit the damage?” Lewis, a former State Department and Commerce official, continued. “There will be a gap, there will be a decline, there will be problems. It might take us six months or a year to climb out of that.”
News of Painter’s exit emerged this week. Painter, with more than 20 years of experience in cybersecurity issues at the federal level, took the job as coordinator in 2011 and is widely revered for his work raising the profile of cybersecurity across the international community. Many say his shoes will be difficult to fill.
“He knows so many leaders throughout the world. Being able to pick up where he left off will be a challenge,” said Megan Stifel, a fellow with the Atlantic Council’s Cyber Statecraft Initiative and a former attorney in the national security division at the Department of Justice. “It’s not insurmountable.”
Painter will exit as the department continues to work on an engagement strategy for international cooperation in cybersecurity, mandated by an executive order that President Trump signed on May 11.
Former officials expect that work on the strategy will continue regardless of Painter’s departure, though they note the appointment of a new cyber coordinator could complicate its implementation.
The coordinator is responsible for engaging with other nations on cyber issues, serving as the department’s go-between to the White House and other agencies on cybersecurity and working as a liaison to the private sector.
Complicating matters are rumblings that the State Department will move the Office of the Coordinator for Cyber Issues under the Bureau of Economic and Business Affairs, severing the coordinator’s direct line to Secretary Rex Tillerson.
The move would be part of a larger effort to redesign the department, which is currently under review by Tillerson and expected to be completed in September. Without confirming that the department was considering closing the cyber office, a State Department official told The Hill that “there are no predetermined outcomes” of the reorganization review.
Many acknowledge that operations at State, particularly those on cyber, should be reviewed and potentially changed.
But Lewis and others believe that the move will be seen as an effort to downgrade the cyber coordinator and deprioritize cybersecurity engagement.
“It’s normal when administrations change to see people change jobs. That part I think they’ll accept. It depends on what State does with the job,” Lewis said of the international community. “If it’s a downgrade and a move to the economic bureau, they’re going to say the U.S. isn’t serious anymore.”
Moving the bureau, he said, “goes against everything we’ve been doing for the last decade.”
“It’s taking an issue that’s pre-eminent and putting it inside a backwater within the State Department,” Rob Knake, a senior fellow at the Council on Foreign Relations who served as director for cybersecurity policy at the National Security Council under former President Obama, told Bloomberg. “Position to power matters both within the U.S. government and within the international community.”
Stifel noted that the economics bureau — which includes a division dedicated to international communications and information technology policy — could signal that the administration is shifting the focus on cybersecurity to an economic and commercial lens.
While she argued that such a move would make sense, she emphasized that the new administration would need to communicate to foreign partners that it does not mean the issue of cybersecurity is losing importance.
“If it were me, I would be looking at ways to message this as a re-emphasis of the importance of the issue,” Stifel said.
For now, it is unclear who will ultimately replace Painter. The department would not say whether it is currently considering candidates, or whether the role will be filled by the time of his departure on July 31. Painter is expected to return to the Justice Department after a period of personal leave.
His exit comes as scores of positions at the department remain unfilled as a result of a slow nomination process and a hiring freeze maintained since Trump took office.
The State official signaled that the department’s work on cyber would not stop with his exit.
“The Department of State continues to promote an open, interoperable, secure and reliable cyberspace,” the official said. “The Department also remains committed to working with foreign partners to deter malicious activity in cyberspace, bolster global cybersecurity and, ultimately, avoid conflict in cyberspace.”