Thompson pushes DHS worldwide threats hearing on Iran cyber campaign
The ranking member's letter arrives while CISA's Iran PLC advisory has been updated once since April and the agency remains hamstrung by a DHS shutdown that keeps roughly two-thirds of its staff out of the office.
TL;DR
House Homeland Security ranking member Bennie Thompson (D-MS) is pressing Chairman Andrew Garbarino (R-NY) to convene a worldwide threats hearing, citing the July 22 update to CISA's joint advisory on Iran-affiliated actors exploiting internet-connected PLCs across U.S. critical infrastructure. Thompson also flags AI and quantum computing risks, the loss of nearly one-third of CISA's workforce over 18 months, and a DHS shutdown that Noem acknowledged has hampered the agency's threat-sharing with critical infrastructure stakeholders.
Thompson's September 1 letter to Garbarino frames the request as a return to committee practice (the last worldwide threats hearing was December 11) but the substance is a catalog of what's changed since. Top of the list: Iran.
The CISA advisory on Iranian-affiliated PLC exploitation, originally published April 7, got its July 22 update adding detection guidance for malicious changes in Rockwell Automation reusable code modules and expanding the manufacturer scope to Schneider Electric, Siemens, and potentially others. Thompson cites it directly. Tenable has linked a July wave of water-utility attacks to Iran-affiliated actors, though the U.S. government hasn't formally attributed that campaign.
What the hearing request surfaces beyond Iran
Thompson also names AI and quantum computing as threats to existing security frameworks, and he sounds the alarm on CISA's headcount: nearly one-third of the workforce gone over 18 months, with a former acting director pegging the vacancy rate across key mission areas at nearly 40 percent. CISA Acting Director Nick Andersen has said the agency is on a hiring plan, but Thompson's letter notes it's racing to onboard people while the technology threat evolves.
The DHS shutdown compounds the workforce problem. Secretary Kristi Noem told the House Judiciary Committee that roughly two-thirds of CISA isn't in the office, directly affecting the agency's ability to share threat information with critical infrastructure operators, the same operators the Iran advisory is trying to reach.
The grant-program squeeze
Thompson also raises a separate fight: the administration is conditioning grant funds on state adoption of election guidelines, which he calls an end-run around congressional authority. NASCIO, in its own August 31 letter to leadership, is pushing to reauthorize the state and local cybersecurity grant program before its September 30 expiration, pointing to the same municipal water-system attacks Thompson cites.
The letter doesn't guarantee a hearing. But the constellation of issues (an active OT campaign, a depleted and partially shuttered CISA, an expiring grant program) gives Thompson's request more weight than a routine minority-party letter.
Published ·Deep Fathom