"Critical infrastructure partnerships strain due to turbulence within the US government, leaving these systems in a potentially delicate state"
The Trump administration's approach to public-private partnerships for protecting U.S. critical infrastructure has seen significant changes, with a notable shift in responsibility from the federal government to state and local authorities. This shift, aimed at reducing federal support, has resulted in reduced funding and staffing for cybersecurity efforts, such as election security, while emphasizing the importance of preparedness at the state and local levels [2].
One of the key aspects of this change is the introduction of "cyber norms" in the national cybersecurity strategy, intended to facilitate cooperation between public and private sectors. However, the administration's emphasis on deregulation and market-driven policies, particularly in critical sectors like energy, continues to be a focus [5][1].
Current impacts of these changes are evident, with reduced federal resources and support straining local and state cybersecurity efforts, especially in sectors vulnerable to ransomware attacks, such as elections and healthcare [2][4]. The shift in responsibility also presents challenges for under-resourced state and local entities that lack the funding and expertise to manage complex cyber and physical threats effectively [2][4].
Public-private information sharing networks have experienced cuts and pauses pending policy reviews, disrupting the flow of critical threat intelligence between government agencies and infrastructure operators [2]. In the energy sector, deregulation and fossil fuel infrastructure expansion have impacted the sector's resilience and complicated integration with clean energy technologies, essential for infrastructure modernization [1].
Potential future consequences may include increased risks of cyberattacks and physical disruptions due to uneven preparedness and resource gaps at sub-federal levels [2][4]. Ongoing tension between deregulation-driven market forces and the need for robust governmental oversight to ensure critical infrastructure resilience is a growing concern, especially as threats from ransomware and AI-driven cyberattacks grow [1][4].
The reliance on state and local authorities may accelerate the development of varied, patchwork security practices across jurisdictions, complicating national-level coordination during large-scale crises [2]. Key sectors like healthcare and election infrastructure may face heightened vulnerability, potentially affecting public confidence and national security [2][4]. Future policies may need to reconcile the federal-state balance and reinvest in public-private collaboration frameworks, especially to protect critical infrastructure from evolving cyber and physical threats [5].
The oil and natural gas industry is currently refusing to share the products of its cyber working groups with the government until they are assured that they have the CIPAC protections. Some critical infrastructure communities express concern about what would happen in the event of a major cyberattack due to the current level of government support [6][7].
The Department of Homeland Security's elimination of the Critical Infrastructure Partnership Advisory Council (CIPAC) framework in March has been the most seismic disruption. CIPAC allowed government and industry representatives to discuss sensitive cybersecurity information without meeting standard transparency requirements that would expose that information to the public [8]. Interviews with industry representatives indicate that government leaders have canceled meetings, forced out longtime points of contact, stopped attending key industry events, and scrapped a coordination program [9].
As a result, infrastructure operators worry about filling any void in information sharing left by a shrinking government, particularly in the event of a devastating cyberattack. Many of CISA's regional advisers have left, leaving infrastructure operators without key points of contact for cybersecurity help. Threat briefings have become uneven as relationships with agencies have grown strained and federal workers have retired or been laid off [10].
The healthcare industry is meeting less regularly with HHS to discuss critical infrastructure cybersecurity, according to industry representatives. The EPA has canceled a series of planned meetings with state water overseers, compounding what industry leaders said was the EPA's already-anemic ability to help the sector withstand attacks [11].
The absence of CIPAC has forced the telecommunications sector to suspend or modify several projects it was working on with the government, causing a significant impact [12]. The result is reduced trust between the public and private sectors, a diminished understanding on each side of the other side's needs and concerns, a declining capacity to plan for future attacks, and a growing national vulnerability to debilitating hacking campaigns [13].
Federal agencies are working on a replacement for CIPAC that would broaden the range of private-sector participants in meetings, according to multiple industry figures [14]. Industry officials say they're not waiting around for the government to tell them how to protect their sectors due to cutbacks and missing points of contact [15]. The Joint Cyber Defense Collaborative, launched by CISA in 2021, has seemingly fallen dormant [16].
In summary, the Trump administration's reorientation towards state-led infrastructure protection and deregulation has reduced federal support and altered public-private partnerships, leading to mixed impacts on infrastructure security and raising concerns about preparedness and resilience in key sectors going forward [2][4][5].
- The Trump administration's shift in responsibility for critical infrastructure cybersecurity has led to a reduction in federal funding and staffing, resulting in a strain on state and local security efforts, particularly in sectors vulnerable to ransomware attacks.
- The administration's approach to public-private partnerships has introduced "cyber norms" in the national cybersecurity strategy, emphasizing cooperation between the public and private sectors, but the emphasis on deregulation has presented challenges for under-resourced state and local entities.
- The elimination of the Critical Infrastructure Partnership Advisory Council (CIPAC) has caused a void in information sharing between government agencies and infrastructure operators, leaving operators without key points of contact and reduced trust between the public and private sectors.
- The healthcare industry is meeting less regularly with HHS to discuss critical infrastructure cybersecurity matters, potentially increasing vulnerability in this sector and affecting public confidence.
- Future policies may need to address the balance between federal and state responsibilities, reestablish effective public-private collaboration frameworks, and prioritize investments in protecting critical infrastructure from cyber and physical threats, including evolving ransomware and AI-driven attacks.
