Cybersecurity and Infrastructure Security Agency

Based on Wikipedia: Cybersecurity and Infrastructure Security Agency

The Agency That Guards America's Digital Gates

In November 2020, a man named Christopher Krebs became one of the most talked-about government officials in America—not for what he did wrong, but for what he did right. As director of an obscure federal agency most Americans had never heard of, Krebs publicly declared that the 2020 presidential election was the most secure in American history. Days later, President Trump fired him via Twitter.

The agency Krebs led was the Cybersecurity and Infrastructure Security Agency, known by its acronym CISA. And the story of CISA—its creation, its mission, its controversies, and its uncertain future—tells us something profound about how modern governments grapple with threats that exist nowhere and everywhere at once.

What Exactly Does CISA Do?

To understand CISA, you first need to understand what "critical infrastructure" means. It's not just bridges and power plants, though those count too. Critical infrastructure is everything a society needs to function: the electrical grid that powers your home, the water treatment plants that make your tap water safe to drink, the financial networks that let you buy groceries with a credit card, the hospitals that keep people alive, and increasingly, the computer systems that connect all of these together.

When someone talks about a "cyber attack," they might mean any number of things. At the mild end, it could be someone defacing a website—the digital equivalent of graffiti. At the severe end, it could be a foreign government stealing military secrets or planting malware that could shut down a power grid. The word "cyber" has become so overused it almost sounds quaint now, like something from a 1990s movie about hackers. But the threats are real, and they're getting worse.

CISA sits within the Department of Homeland Security, the sprawling agency created after the September 11 attacks to consolidate America's domestic security functions. CISA's job is to protect critical infrastructure—both physical and digital—across every level of government. It coordinates cybersecurity programs with state governments, helps private companies defend against hackers, and works to stop both criminal organizations and hostile foreign governments from breaching American systems.

Think of it as the federal government's defensive cybersecurity team. While agencies like the National Security Agency focus on offensive capabilities and intelligence gathering, CISA focuses on defense—patching vulnerabilities, detecting intrusions, and helping organizations recover when they've been breached.

From Obscure Directorate to Household Name

CISA didn't always exist as a standalone agency. It began in 2007 as something called the National Protection and Programs Directorate—a bureaucratic mouthful that told you almost nothing about what it actually did. For eleven years, this directorate labored in obscurity within the Department of Homeland Security, slowly building capabilities and expertise.

Then, in November 2018, President Trump signed the Cybersecurity and Infrastructure Security Agency Act. This law elevated the directorate into a full-fledged agency with a clear name and expanded mission. Christopher Krebs, who had been serving as the directorate's undersecretary, became CISA's first director. Matthew Travis became his deputy.

The timing was significant. By 2018, it had become impossible to ignore how vulnerable America's digital systems were. Russian hackers had interfered in the 2016 election. North Korean hackers had launched ransomware that crippled hospitals. Chinese hackers had stolen the personal data of millions of federal employees from the Office of Personnel Management. Cybersecurity was no longer a niche concern—it was a matter of national security.

CISA's mandate expanded quickly. The agency took on responsibility for protecting the census, managing security for major national events, and eventually coordinating parts of the federal response to the COVID-19 pandemic. It worked on securing 5G telecommunications networks, the next generation of mobile technology. It studied how to protect the electrical grid from electromagnetic pulses—the kind of energy burst that could be caused by a nuclear weapon or, in theory, a massive solar flare. It even housed the Office for Bombing Prevention, leading the national effort to counter improvised explosive devices.

But of all CISA's responsibilities, none would prove more consequential—or more controversial—than its role in election security.

The Battle Over Election Security

American elections are a patchwork. There is no single national election system. Instead, thousands of local jurisdictions run their own elections with their own systems, their own rules, and their own vulnerabilities. This decentralization has advantages—it makes it nearly impossible for a single attack to compromise the entire country's elections. But it also creates challenges, because many local election offices lack the resources or expertise to defend against sophisticated hackers.

CISA stepped into this gap. The agency offered free security assessments to state and local election officials. It provided threat intelligence—information about what foreign hackers were doing and how to stop them. It conducted penetration testing, essentially hiring ethical hackers to try breaking into election systems before malicious actors could.

In 2020, as the presidential election approached, CISA created a website called Rumor Control. The purpose was simple: to rebut false claims about election security as quickly as they spread. When viral posts claimed that voting machines were switching votes or that ballots were being thrown away, Rumor Control provided fact-checks from the agency responsible for actually securing those systems.

On November 12, 2020—nine days after Election Day—CISA issued a statement that would define its legacy in many people's minds. "There is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised," the agency declared. This was not a partisan statement. It was a technical assessment from the federal agency tasked with protecting election infrastructure.

Christopher Krebs knew what was coming. That same day, he told associates he expected to be fired. Five days later, on November 17, President Trump dismissed him via Twitter, claiming without evidence that Krebs's statement was "highly inaccurate."

The irony was thick. Krebs had been appointed by Trump. He had served the administration loyally for years. His sin was simply telling the truth about the security of an election that his boss had lost.

The Scale of the Threat

While election security grabbed headlines, CISA was simultaneously fighting a much larger battle that most Americans never saw. The statistics are staggering.

In 2020 alone, the number of data breaches reported in the United States reached 3,932—a record high representing a forty-eight percent increase over the previous year. More than thirty-seven billion records were exposed globally. The average cost of a data breach reached $3.86 million, and organizations took an average of 280 days—more than nine months—just to identify and contain a breach after it occurred.

These numbers represent real harm: stolen identities, drained bank accounts, compromised medical records, exposed trade secrets. And they only capture the breaches that were detected and reported. Many intrusions go unnoticed for years, or are never disclosed publicly.

CISA responded by deploying something called the EINSTEIN system across federal government networks. Think of EINSTEIN as a massive alarm system. It monitors network traffic flowing into and out of federal agencies, looking for signatures of known malicious activity. When it detects something suspicious, it alerts security teams who can investigate and respond.

The agency also issues what it calls "binding operational directives"—orders that require federal agencies to take specific actions against cybersecurity threats. When CISA identifies a critical vulnerability being actively exploited by hackers, it can compel agencies to patch their systems within days or weeks, rather than leaving each agency to decide on its own timeline.

In January 2019, CISA issued its first emergency directive, warning that an active attacker was targeting government organizations using a technique called DNS spoofing. To understand this attack, imagine someone secretly changing the address on your mail so that letters addressed to your bank actually go to a criminal's address. That's essentially what DNS spoofing does with internet traffic. Investigators traced the attack to actors with connections to Iran.

Cognitive Infrastructure and the Disinformation Challenge

In August 2021, CISA's new director made a statement that would prove prophetic—and controversial. Jen Easterly, who had been confirmed by the Senate after a delay caused by unrelated political maneuvering, observed that while CISA was in the business of protecting critical infrastructure, perhaps the most critical infrastructure of all was "cognitive infrastructure."

What did she mean by cognitive infrastructure? She was talking about the shared understanding of reality that allows a democracy to function. If citizens can't agree on basic facts—like whether an election was conducted fairly—then the entire system starts to break down. Disinformation and misinformation become, in this framing, attacks on the infrastructure of democracy itself.

This represented an expansion of CISA's mission that some found natural and others found alarming. Under Easterly, the agency hired staff to monitor online disinformation and expanded the Rumor Control website beyond just election-related claims. The agency created a Cybersecurity Advisory Committee that included tech executives, security researchers, and experts on disinformation—people like Kate Starbird, a University of Washington professor who studied how false information spreads online.

Critics saw government overreach. To them, a federal agency monitoring and "correcting" online speech—even if it was false—came dangerously close to government censorship. Supporters countered that CISA wasn't silencing anyone; it was simply providing accurate information to counter falsehoods being spread by hostile foreign actors.

This tension would ultimately shape CISA's future in ways no one fully anticipated.

The Anatomy of a Federal Agency

Headquartered in Arlington, Virginia, CISA is a surprisingly large organization. The agency is planning to move its headquarters and approximately 6,500 employees to a new facility on the Department of Homeland Security's consolidated campus at St. Elizabeths in Washington, D.C.—a ten-story, 620,000-square-foot building that will make CISA's presence much more visible.

The agency is organized into several major divisions, each handling a different aspect of its mission.

The Cybersecurity Division is the largest and most technically focused. Within it sits the National Cybersecurity and Communications Integration Center, which serves as a hub for coordinating responses to cyber incidents. The division also includes teams focused on threat hunting—proactively searching for hackers who may have already breached systems—and vulnerability management, which works to identify and patch security holes before attackers can exploit them. The Joint Cyber Defense Collaborative brings together government agencies and private companies to share threat information in real time.

The Infrastructure Security Division handles physical threats. This is where you find the Office of Bombing Prevention, which leads national efforts to counter improvised explosive devices. The division also includes teams focused on chemical security, school safety, and critical infrastructure assessment.

The Emergency Communications Division ensures that first responders—police, firefighters, paramedics—can communicate during disasters. When a hurricane hits or a terrorist attack occurs, reliable communications can mean the difference between life and death.

The National Risk Management Center takes a broader view, analyzing systemic risks to critical infrastructure and developing strategies to address them. The Stakeholder Engagement Division manages relationships with the private sector, state and local governments, and international partners.

One of CISA's lesser-known responsibilities is managing the .gov top-level domain—the internet address suffix used by government websites. In 2021, the agency took over this function from the General Services Administration and eliminated the fee for registering .gov domains, making it easier for legitimate government entities to claim their online identity before scammers could impersonate them.

The 2025 Dismantling

When Donald Trump returned to the presidency in 2025, he had not forgotten what CISA had done in 2020. The agency's public statement that the election was secure had contradicted his claims of widespread fraud—and he had been nursing that grievance for four years.

The new administration moved quickly to dismantle the agency's most visible programs. CISA's efforts to monitor foreign influence operations were canceled. Programs tracking foreign election disinformation were shuttered. Even contracts for penetration testing of local election systems—the kind of proactive security work that helps identify vulnerabilities before adversaries can exploit them—were terminated.

The irony was bitter. These programs had been designed to protect America from foreign adversaries—Russia, China, Iran—who were actively working to undermine American democracy. Now they were being canceled not because they didn't work, but because they had worked too well. They had accurately reported the security of an election that some preferred to cast doubt upon.

What remains of CISA is unclear. The technical capabilities remain—the EINSTEIN system still monitors federal networks, the threat hunting teams still search for intruders, the incident response teams still help organizations recover from breaches. But the broader mission of protecting America's "cognitive infrastructure" appears to be over.

The Fundamental Tension

CISA's story illuminates a tension at the heart of modern governance. In a world where disinformation can spread faster than truth, where foreign adversaries can attack a country without ever firing a shot, where critical infrastructure is only as strong as its weakest digital link—how should democracies defend themselves?

There are no easy answers. A government agency that monitors and corrects online speech, even false speech, carries obvious risks. But a government that stands by silently while foreign adversaries flood the information environment with lies carries risks of its own. The line between defending democracy and threatening free speech is easier to draw in theory than in practice.

What seems clear is that the threats CISA was created to address have not disappeared. The number of cyber attacks continues to grow. Ransomware gangs hold hospitals and cities hostage. Foreign hackers probe critical infrastructure for weaknesses. Nation-states develop ever more sophisticated capabilities to disrupt their adversaries.

Whether CISA—in whatever form it takes—can meet these challenges depends on decisions yet to be made. But the need for someone to guard America's digital gates is not going away. The only question is who will do it, and how.