U.S. Rep. Andrew Garbarino (R-NY) urges the U.S. Department of Homeland Security to look into the structure of the Cyber Safety Review Board (CSRB) as the Trump administration considers reconstituting it.
In a letter to DHS Secretary Kristi Noem, Garbarino, the chair of the House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection, asked officials to examine the board’s transparency, accountability and efficacy. The letter said thought the board has been tasked with investigating major cyber incidents, it has faced several challenges.
“I request a thorough review of the Board’s structure prior to its reconstitution—something Deputy Secretary Troy Edgar indicated may happen during his confirmation hearing. It is impossible to call a body “independent” when its members—who serve on a part-time basis—are selected without clear selection criteria…Although private sector individuals are required to serve in their personal capacities, that is impossible to guarantee with part-time membership,” he wrote. “The cybersecurity ecosystem is too intertwined to absolve members who may work at competitor companies of conflicts of interest, which potentially impacts the CSRB’s ability to produce objective analyses.”
Garbarino asked for more information about the board choses incidents for review, what the criteria is for board membership, how part-time membership affects the board’s engagement, how the board decides its final recommendations and whether subpoena authority would help the board in its review process.
“Lack of transparency about the CSRB’s appointment process may threaten the model and efficacy of the Board. Industry members regularly interact with CISA, given the Agency’s role as a ‘trusted partner’ to the public and private sectors. As such, they may curry favor with the CISA Director for an appointment, potentially putting themselves in a position to directly investigate their competitors,” Garbarino wrote. “Since the selection and recusal process of industry members for the Board is not transparent to Congress or the American people, there is currently no accountability mechanism to prevent conflicts of interest. This may deter entities involved in each incident from cooperating with the CSRB, as they may become increasingly reluctant to voluntarily share information with a Board that includes competitor organizations.”