‘Absolute right guy for the job’: New cyber chief takes reins amid the chaos

1

Five months before President Donald Trump fired him, federal cybersecurity chief Chris Krebs made a key addition to his leadership team — a career employee he trusted to take charge if shifting political winds threatened to leave his agency rudderless.

Those winds arrived on Wednesday, and now Brandon Wales is leading the Cybersecurity and Infrastructure Security Agency as it becomes the latest arm of the executive branch to take the brunt of the White House’s post-election purge.

Wales, CISA’s top career staffer and officially its executive director, became its acting director on Wednesday after Trump fired Krebs for debunking the baseless election-related conspiracy theories that the president and his allies are promoting. At least for now, that debunking continues — the agency “Rumor Control” website that so angered the White House was still operating Wednesday afternoon, although Wales has not continued Krebs’ practice of indirectly trolling the president on Twitter.

The new chief is a veteran of roles both prominent and obscure at CISA’s parent, the Department of Homeland Security, which he joined just a few years after its post-Sept. 11 creation. And he’s the ideal person to take over at such a moment of chaos, seven current and former colleagues say. They describe him as brilliant, calm under pressure and better versed in DHS’s cyber mission than virtually anyone else.

One ex-colleague said Wales has even had experience in helping DHS’s leadership organize efforts to secure U.S. election security at a time when the subject drew little interest from the Trump White House.

In other words, Trump’s purge of CISA’s leadership has unintentionally elevated the very official whom Krebs put in place to protect the agency in a situation like this. And unlike Krebs and former CISA Deputy Director Matthew Travis — who submitted his resignation under White House pressure after Krebs’ firing — Wales is not a political appointee who can be ousted at Trump’s whim.

“He is one of the smartest people I’ve ever worked with, certainly one of the smartest guys at DHS,” said Bryan Ware, who led CISA’s Cybersecurity Division until he too resigned last week under pressure from the White House. “I just can’t think of anybody who’s better prepared for this job than him.”

“He’s the most even-handed guy you’re ever going to meet,” said a current U.S. executive-branch official who has worked with Wales and requested anonymity to speak candidly. “I think he’s the absolute right guy for the job.”

Wales is still deciding how to engage with the public, one person familiar with his plans said Wednesday. The person said Wales plans to keep CISA’s Rumor Control website active but, unlike Krebs, does not plan to tweet about it.

In an email to CISA employees obtained by POLITICO, Wales urged staff to stay the course. “A change in leadership is not a change in mission,” he wrote.

Wales noted that the 2020 election cycle continues, including in Georgia, where two run-off Senate elections will decide control of the upper chamber.

“We made great strides in our election security efforts,” he wrote, “and we need to stay focused on continuing to provide the assistance and guidance that state and local election officials have come to rely on.”

While Wales was adjusting to the abrupt transition Wednesday, CISA employees tried to carry on as usual despite Krebs’ firing, said one staff member, who added that they have been thanking and celebrating Krebs on the agency’s Microsoft Teams chat platform. “Thank you for your service and leadership, Chris,” one message said, according to the employee. Another called Krebs “a true public servant.”

Other than that, “it’s pretty quiet, just another Wednesday doing the work,” said the employee, who requested anonymity to speak freely.

Gaining experience under the radar

Wales’ low public profile — he does not appear to have accounts on Twitter or even LinkedIn — belies his extensive experience in both the bowels of DHS and its highest echelons.

Wales, 43, earned a bachelor’s degree from The George Washington University and a master’s degree from Johns Hopkins’ School of Advanced International Studies before serving as a national security adviser to former Sen. Jon Kyl (R-Ariz.). But he has spent most of his career at DHS. He joined the department in 2005, shortly after its creation, ran its Homeland Infrastructure Threat and Risk Analysis Center from 2009 to 2014, and spent the next three years running its Office of Cyber and Infrastructure Analysis.

“He is very smart, a good analyst and terrific briefer,” said Suzanne Spaulding, who created OCIA while running DHS’s cyber wing during the Obama administration.

From August 2017 to January 2019, while still officially an employee of CISA’s predecessor division, Wales served on a detail as a senior counselor on cyber issues to DHS Secretary Kirstjen Nielsen. (For part of this time, Nielsen’s chief of staff was Chad Wolf, a connection that could help Wales now that Wolf is the acting secretary and his boss.) In January 2019, Nielsen made him her deputy chief of staff. He became chief of staff that June, under then-acting Secretary Kevin McAleenan.

Ware, who started working with Wales in the years after DHS’s creation and later served with him when they were Nielsen’s cyber advisers, said his deep knowledge of the department would prove invaluable.

“He’s really been at the table for every major cyber event that DHS has been a part of,” Ware said, “both in his capacity as an analyst and leading teams of analysts … but also because he was the cyber adviser to the secretary, the chief of staff to the secretary, so he’s had direct access and direct involvement at the highest levels across the interagency for a long time now.”

That meant that Wales was in place at DHS as the Chinese government breached the White House and military computer networks in 2008; Iran waged cyberattacks against U.S. banks from 2012 to 2013; Russian hackers intruded into the White House and State Department in 2014; North Korea breached Sony Pictures Entertainment in 2014; China hacked the Office of Personnel Management in 2015, stealing millions of highly sensitive security clearance files; and Russia interfered in the 2016 election.

Wales’ work across DHS, especially in the secretary’s office, prepared him to “navigate some of the competing equities and the personalities” who factor into any major decision, said the U.S. official.

“Brandon’s reputation is one of supreme intellect — someone who understands very, very complexed, nuanced ideas in and out but also can translate that for more policy-minded folks,” the official said.

As DHS’s leadership changed, this official recalled, Wales remained a “cornerstone person,” with a reputation such that “everybody can trust him.”

In 2018, as the White House ignored Nielsen’s requests to focus on election security and declined to convene certain National Security Council meetings, she tapped Wales to work with Krebs in her previously reported efforts to bypass the White House.

“Brandon was instrumental in saying, ‘Fine, if the White House won’t do it, we’ll do it, we’ll create a ghost NSC, and we’ll pull together these meetings, and we’ll invite all the different agencies that should be there, and we’ll just do the coordination ourselves,” said Miles Taylor, who was Nielsen’s chief of staff at the time. Those meetings on election security created the coordination needed to effectively protect the midterm elections in 2018, he said.

“He was really the one who drove that train for Nielsen,” Taylor said, “and it made a huge difference.”

In December, Wales returned to CISA to lead its strategy and planning office. “Brandon’s breadth of experience in the Department and within CISA has prepared him well for this role,” Krebs told employees in an email obtained by POLITICO.

In June, Krebs promoted Wales to be CISA’s executive director, a position he’d created to ensure that an experienced career staffer could lead the agency during a political transition — whether that was a standard handoff between administrations or a White House purge of the agency’s leadership, as happened this week.

Providing continuity

When he arrived at CISA from the secretary’s office, Wales “was immediately Chris’s right-hand man … because of his superb reputation and acknowledged expertise,” said the U.S. official who has worked with him. “Chris was signaling to the community that he was the next in line.”

A Democratic congressional staffer recalled talking to Wales about cyber provisions in this year’s defense policy bill.

“He certainly impressed me with his ability to get into some of the nitty gritty,” said the staffer, who requested anonymity to discuss private conversations. “He really had a firm grasp of the policy stuff.”

Wales also impressed people with how easily and humbly he switched from being a Cabinet secretary’s senior adviser to being the top staffer at a DHS component agency.

“That just demonstrates who he is,” said the U.S. official. “He’s mission focused, and he’s practical. He’s not out there for the spotlight. … He’s there to do the job.”

Several months ago, when a transition seemed inevitable, Ware began taking Wales with him to “all of my meetings with our intelligence community partners and law enforcement partners,” he said. A few days before Ware resigned, Wales led one such meeting with officials from the FBI, the NSA, U.S. Cyber Command and other CISA partners. “I think he’s ready,” Ware said. “He’s known to and supported by CISA’s partners.”

“I think honestly he’s been mentally preparing for this job for months,” the U.S. official said.

Now comes the hard part

Wales is no stranger to high-pressure environments, his colleagues said, though this one is particularly unusual: CISA is firmly in the president’s sights after publicly disputing baseless White House claims of election fraud, amid a wholesale purge of national security leaders who have bucked Trump.

People who know Wales say he is up to the task.

“He’s been in the pressure cooker of being the chief of staff for the whole department,” said Ware, “so I believe he has the experience and the wherewithal to withstand a very difficult couple of months as we transition the agency to new political leadership.”

As McAleenan’s chief of staff, Wales fielded many “hyper-politicized” and potentially illegal requests from the White House, Taylor said, so “he’s really well-equipped to protect the agency from that sort of activity in this time period.”

Even so, Wales’ elevation comes at a precarious moment for CISA. In addition to the vacant director and deputy director positions, both the agency’s Cybersecurity Division and Infrastructure Security Division lack permanent leaders. At CISA’s partner agencies, including the FBI and the NSA, those division leaders’ counterparts are career government employees, but at CISA, they are presidential appointees.

CISA’s chief of staff sent employees an email late Tuesday urging them not to “lose focus on the important work we collectively undertake on behalf of the American people.”

Despite his reputation for unflappability, Wales is likely feeling somewhat “overwhelmed” by his newfound responsibility for a massive national security agency, Ware said.

“This isn’t a grab-the-brass-ring moment for Brandon,” Ware added. “This is his duty, and I’m sure he feels the honor and responsibility to execute to his best ability. But I don’t think this is the kind of circumstance that Brandon was aspiring for by any stretch.”

Looming over Wales is the possibility that Trump could appoint a new acting director, someone who would amplify rather than debunk his election claims. Similar moves have already occurred at the Pentagon, where Trump installed a new acting defense secretary who bypassed the line of succession after firing former Secretary Mark Esper.

Trump said in October that he planned to appoint Sean Plankey, a top Energy Department cyber official, to lead CISA’s infrastructure security division. When Plankey starts his job at CISA, he will be one of the few non-acting senior leaders there. A former DHS official, who requested anonymity to speculate about future moves, suggested that Trump could use Plankey’s status to make him the new acting director and displace Wales. The former official described Plankey as a Trump supporter.

If such a move is coming to CISA, employees don’t know anything about it, Ware said.

“There have been a lot of surprises in the last week that have come from the White House,” he said, “and I expect that those might continue.”

Martin Matishak contributed to this report.

View original post