DHS’s cyber agency is led by career official Brandon Wales. For now.

Less than 24 hours after President Donald Trump fired Chris Krebs, the dust is still settling at the Department of Homeland Security cybersecurity agency that Krebs led.

Officials at the Cybersecurity and Infrastructure Security Agency (CISA) who have spent months refuting conspiracy theories and battling disinformation surrounding the election say they will continue to do so, despite a White House purge of the agency’s leadership.

CISA is now led on an acting basis by Brandon Wales, a 15-year veteran of DHS who is deeply familiar with CISA’s operations after serving as the agency’s top career civil servant. A former senior cybersecurity adviser to then-Homeland Security Secretary Kirstjen Nielsen, Wales is well-liked at CISA and known for his technical acumen.

In an email to the CISA workforce Wednesday afternoon, Wales urged his colleagues to continue to provide cybersecurity support to health care organizations threatened by ransomware attacks during the pandemic, and to prioritize election security efforts as states certify vote tallies.

“We made great strides in our election security efforts, and we need to stay focused on continuing to provide the assistance and guidance that state and local election officials have come to rely on,” Wales wrote.

How long Wales will lead the agency remains unclear. The dismantling of CISA’s leadership has employees on edge. And CISA’s continued work to debunk fraud claims could draw additional White House scrutiny.

After Trump fired Krebs via tweet on Tuesday evening, Krebs’ deputy, Matt Travis, resigned under pressure from the White House, Travis said. (A DHS spokesperson disputed that Travis was forced to resign.) Last week, the White House also forced out Bryan S. Ware, CISA’s assistant director for cybersecurity.

But Trump cannot easily fire all of CISA’s senior officials. Wales’ status as a civil servant, for example, protects him from being sacked without cause. And CISA’s existence as an agency is codified into a law that Trump himself signed in 2018.

The most senior political appointee positions at CISA are currently vacant. In October, the White House said it would nominate Sean Plankey, a Department of Energy official, as CISA’s assistant director. But at press time Wednesday, Plankey remains at DOE. Neither the White House nor DOE responded to a request for comment about Plankey’s status.

Remaining CISA officials are still carrying out their work on election security and monitoring for disinformation campaigns that could undermine confidence in the vote.

“The President has designated Executive Director Brandon Wales as Acting Director,” CISA chief of staff Emily Early wrote in an email to staff Tuesday night, as CNN first reported. “A change in leadership is not a change in mission and it’s essential that we do not lose focus on the important work we collectively undertake on behalf of the American people.”

CISA’s “rumor control” website, which debunks election-related conspiracy theories, including some propagated by Trump, remains online. On Wednesday morning, Matt Masterson, CISA’s election-security lead, said the agency would plow ahead with its work.

https://twitter.com/mastersonmv/status/1328930975347249155?s=20

For his part, Trump has showed no signs of changing tack. He continued to tweet conspiracy theories about his electoral defeat to Joe Biden on Wednesday morning.

Running a $2 billion startup

Ware told CyberScoop that Wales is “the best guy for the job.”

“He’s absolutely one of the smartest, hardworking people in government and has had a front row seat to every major cyber event at DHS these last few years,” Ware said.

Wales now has the challenge of running a “2,500-person, $2 billion start-up whose entire leadership team was just decapitated in the last week,” Ware said, referring to CISA. (The agency has roughly 2,050 full-time-equivalent employees.)

Travis told CyberScoop that he hopes Wales can lead “an effective transition to the Biden team” and complete “the agency-wide transformation that Chris and I had engineered.”

Democratic lawmakers and former national security officials affiliated with both political parties have warned that the Trump administration’s refusal to cooperate with Biden’s transition team risks damaging national security. Paradoxically, the dismantling of CISA’s leadership makes it easier for those officials to communicate on policy and administrative issues with the Biden transition team.

Brian Harrell, who stepped down as assistant CISA director in August, credited the agency for protecting the election and slammed Trump’s decision to fire Krebs.

“It’s a shame that in this administration, you can be fired for safeguarding the American people and faithfully doing your duties,” Harrell said.