The U.S. government's top cybersecurity official has told people that he expects the White House to fire him, three people familiar with the situation told POLITICO, as the Trump administration continues a purge of officials deemed disloyal to the president.
Chris Krebs, the director of the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency, is in the White House's crosshairs in part because of a website he created to debunk election-related misinformation — much of which President Donald Trump and other Republican Party leaders have embraced as they seek to undermine the legitimacy of President-elect Joe Biden's victory.
In another sign of trouble for CISA, which has for years avoided the chaos of the Trump administration, another top agency official submitted his resignation on Thursday. Bryan Ware, the leader of CISA's Cybersecurity Division, confirmed his departure to POLITICO but did not identify a reason. However, a U.S. official familiar with the matter told Reuters that the White House requested his resignation.
Krebs, one of the few Trump administration officials with widespread bipartisan support and admiration, has been expecting to be fired since just after Election Day, according to three people familiar with his thinking.
Krebs withdrew from an event planned for early December without giving a reason, said a person familiar with the planning of that event.
His agency has been at the forefront of federal efforts to protect U.S. elections from foreign hacking and interference, and his efforts have drawn praise from people in both parties. But Krebs has told people that he believes the White House is unhappy with his efforts to combat disinformation about voter fraud — claims that have primarily been coming from Trump and his allies. And that could make him the latest national security leader to lose his job amid a post-election purge that has already forced out Defense Secretary Mark Esper and other top Pentagon officials.
The White House declined to comment on the issue, and CISA declined to discuss it in detail. "Chris Krebs is the Director of CISA," agency spokesperson Sara Sendek told POLITICO.
Reuters first reported that Krebs has told associates he expects to be forced out.
Speculation about Krebs' fate has heightened among people in tech and national security circles since a POLITICO story on Tuesday reported on his and CISA's efforts to debunk the baseless voter-fraud allegations. Those include CISA's Rumor Control website, which has knocked down rumors such an alleged flurry of votes by dead people, and Krebs' Twitter feed, which he frequently uses to promote the fact-checking page.
People throughout the cybersecurity and technology realms expressed dismay Thursday at the prospect of Krebs' departure.
“Firing Chris Krebs at this point makes no sense," said Michael Daniel, who served as President Barack Obama's cybersecurity coordinator and is now president of the Cyber Threat Alliance, an information-sharing group. "Disrupting CISA’s leadership ... potentially opens a window that adversaries could take advantage of."
Alex Stamos, the former chief security officer at Facebook, said during an election integrity briefing Thursday that Krebs had succeeded in a delicate task. "He's walked this very fine line, I think very well, of trying to address those issues and to raise concerns when appropriate, while also pointing out that the existence of real issues as you have in any complex system does not mean that the election was stolen."
Still, a former senior U.S. official said that "several folks in the government" expected the POLITICO story to result in Krebs' firing.
The White House is particularly angry at CISA for debunking a conspiracy theory, known as "Hammer and Scorecard," about a supposed supercomputer and accompanying software that flipped votes during the election, according to Reuters. Krebs has been particularly vocal in debunking this conspiracy theory, calling it "nonsense" and "a hoax."
On Thursday evening, Krebs retweeted an election technology specialist who warned people not to share "wild and baseless claims about voting machines, even if they're made by the president."
The same day, a group of federal officials, election supervisors and voting technology vendors issued a statement declaring the 2020 election "the most secure in American history" and saying, "There is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised." The group included a representative from CISA.
A technology industry executive familiar with the matter told POLITICO that the White House "was agitated that CISA would not remove some item(s) from their Rumor Control page."
The Rumor Control page has not been the only point of friction between Krebs and the White House, according to a current U.S. official.
The White House's personnel office "has wanted to fire Krebs for a while," said the official, who requested anonymity to discuss internal deliberations. "From what I’ve heard from the [White House], they’ve considered removing him before."
Now some people fear what will happen to the agency's efforts if he departs.
“Chris Krebs is the Administration’s foremost civilian expert on cybersecurity and election integrity," said a former Trump transition official, who requested anonymity to offer a candid reaction. "He put his head down ... and did the country a tremendous service with a laser-like focus on protecting America’s critical infrastructure, including election security. It’s a shame if some inexperienced staffers in the White House blinded by MAGA politics don’t see it that way."
Chris Painter, who served from 2011 to 2017 as the United States' top cyber diplomat, told POLITICO that Krebs "has been a great leader of DHS’ cyber programs and has been particularly effective in fighting election interference."
"The threat of interference and disinformation continues after the election," Painter said. "Firing him now makes no sense and just makes our response weaker."
In a preelection interview with POLITICO, Krebs said he had not experienced any interference from the White House despite countering the Trump administration line on issues such as voter fraud and Russian election interference. “I have always felt that … we have been empowered and able to do our job” at CISA, Krebs said, “and I think we've been pretty damn successful at doing it.”
Krebs, who has led CISA and its predecessor DHS division since early 2017, had been planning to leave his position and return to the private sector shortly after Biden took office. But he had hoped to stay on in the short term to help the Biden transition team and see the new administration into its first few months, the people familiar with his thinking said.
They said Krebs had expressed a hope to people close to him that Ware might take over in the event he were forced out.
CyberScoop first reported Ware's resignation.
Matthew Travis, CISA's deputy director, is a political appointee who is also subject to White House removal. Another person whose job may be in jeopardy is Matthew Masterson, CISA's lead election security staffer. Masterson, whom state and local election officials widely credit with helping to build a robust election security partnership, is also a political appointee whom the White House can order fired if it chooses to do so.
But CISA's third-ranking official, executive director Brandon Wales, is a career civil servant who cannot be fired except with cause.
"Krebs created the Executive Director position as the highest career employee to aid any transition in the absence of political leadership, like if Travis and Krebs were both to leave," said a U.S. official, who spoke anonymously because of the sensitivity of the situation.
"Some [at] CISA are probably worried," the official said of Krebs' potential firing, "but there has been a transition plan in place."
As for CISA's Cybersecurity Division, Ware's departure leaves Matt Hartman, a 10-year veteran of CISA and its DHS predecessor, as the acting leader of the division. Like Wales, Hartman is a career civil servant.
The cyber division focuses on protecting critical infrastructure from cyberattacks and defending federal civilian networks through monitoring, threat-hunting and vulnerability management services. It coordinates with the Infrastructure Security Division, which helps protect critical facilities such as power plants from physical threats, and with the National Risk Management Center, which houses CISA’s Election Security Initiative.
Even as speculation about his fate swirled on social media Thursday afternoon, Krebs stayed on message. During a virtual meeting of DHS's National Security Telecommunications Advisory Committee, he noted that, with upcoming Senate runoff elections in Georgia scheduled for early January, CISA wasn't done protecting the 2020 elections.
"While our nation’s highest-profile election took place last week," he said, "our mission's going to continue: to defend our democracy."
Alexandra S. Levine contributed to this report.