DOD cuts mandatory cybersecurity training; Federal judiciary touts cyber work after major breach

Defense Secretary Pete Hegseth issued a new edict last week to reduce the time personnel spend on cybersecurity training, among other reforms. The directive came in a Sept. 30 memo to senior Pentagon leadership and DOD agency and field activity directors, ordering the military departments, in coordination with the Pentagon’s chief information officer, to “Relax the mandatory frequency for Cybersecurity training.” Hegseth also called for narrowly tailoring records management training to service member roles and allowing flexibility in training delivery, as well as automating information management systems to eliminate training requirements. Additionally, Hegseth directed the military departments and other Pentagon leaders to “relax” the mandatory frequency for controlled unclassified information (CUI) training; remove Privacy Act Training from the Common Military Training (CMT) list; eliminate the mandatory frequency for “Combating Trafficking in Persons” refresher training after appropriate legislation is enacted; consolidate mandatory training topics, “as appropriate”; and develop an integrated CMT program plan. The changes are to be “implemented expeditiously,” per Hegseth’s directive. Federal courts are upgrading their cybersecurity on a number of fronts, but multifactor authentication for the system that gives the public access to court data poses “unique challenges,” the Administrative Office of the United States Courts told Sen. Ron Wyden in a letter last week. Wyden, D-Ore., wrote a scathing August letter to the Supreme Court in response to the latest major breach of the federal judiciary’s electronic case filing system. The director of the Administrative Office of the United States Courts responded on behalf of the Supreme Court. It is “simply not the case” that the courts have, in the words of Wyden, “ignored” advice from experts on securing the Case Management/Electronic Case Files (CM/ECF) system, wrote Robert Conrad Jr., director of the office. Conrad wrote in the Sept. 30 letter: “Substantial planning for the modernization effort began in 2022, and we are now approaching the development and implementation phase of the project. We expect implementation will begin in the next two years in a modular and iterative manner.” In recent years, the office has been testing technical components on its modernization effort, and is centralizing the operation of data standards to enable security, Conrad said. The Daily Scoop Podcast is available every Monday-Friday afternoon. If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.