CISA Rehires Fired Employees, Immediately Puts Them on Leave

The agency charged with protecting U.S. federal networks will rehire terminated probationary employees to comply with a federal judge’s order but plans to place them on immediate administrative leave.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The Cybersecurity and Infrastructure Security Agency announced plans to bring back roughly 130 employees ousted amid President Donald Trump and multi-billionaire special advisor Elon Musk’s push to slash the federal workforce and gut government spending. The move came just ahead of a 1:00 p.m. Monday deadline set by U.S. District Judge James Bredar – a decision that, according to one agency official, sparked confusion inside CISA as the White House vowed to fight the ruling (see: Federal Judges Block Trump’s Mass Firings of Federal Workers).

A spokesperson for CISA declined to say how many staffers have been removed since Trump took office in January, or whether the agency has been unable to reach any of them. In a statement posted on its homepage Monday, CISA said it was “making every effort to individually contact all impacted individuals” and asked those not yet contacted to email their full name, dates of employment, and either a birthdate or Social Security number – a request made without clarification on how the information would be secured.

The White House condemned federal court rulings that stalled Department of Government Efficiency-led firings across dozens of agencies, as CISA and others raced to finalize plans for reinstating employees following multiple decisions last Thursday. Trump said the court orders were “absolutely ridiculous” during a press gaggle aboard Air Force One on Sunday, describing the move to bring back thousands of probationary employees ousted from the federal government in recent weeks a “very dangerous decision for our country.”

Current and former CISA officials are concerned about workforce and budget cuts as the agency faces mounting threats against federal systems and networks. Rob Joyce, a long-time National Security Agency official who served as cybersecurity coordinator on the National Security Council during the first Trump administration, testified earlier this month that the workforce purge “will have a devastating impact on cybersecurity and national security” (see: Ex-NSA Official: Federal Purge Threatens National Security).

The White House, the Department of Government Efficiency and the Office of Personnel Management did not respond to multiple requests for comment. It is unclear how many CISA and other federal employees in key national security and cybersecurity roles have been placed on administrative leave or removed since January.

CISA disputed what it calls “inaccurate reporting” based on accounts from employees and federal contractors, including Christopher Chenoweth, a senior penetration tester for the Department of Homeland Security, who described being removed from his post. Chenoweth said on LinkedIn that his contract was terminated in late February along with more than 100 staffers supporting red team infrastructure – a move CISA defended as an effort to “eliminate duplication of effort” and act “as good stewards of the taxpayer dollar.”

CISA has also defended its decision to defund two national cybersecurity hubs that provide real-time threat intelligence to state and local governments, saying the groups “no longer effectuate department priorities” and emphasizing its commitment to “good stewardship of taxpayer dollars” (see: CISA Defunds Threat-Sharing Hubs for States and Elections).