Post

Scoop: The lone employee behind CISA's Pre-Ransomware Notification Initiative resigned on Friday rather than take a forced reassignment to FEMA. CISA says PRNI will continue, but sources said David Stern's loss will be a major setback for it. My story: www.cybersecuritydive.com/news/cisa-ra...

The PRNI, which launched in late 2022, is one of the most tactile ways in which CISA helps protect critical infrastructure organizations. When CISA gets intelligence from a partner about hackers prepping ransomware activity on a victim network, it alerts the victim.

In an interview with the SANS Institute in August, Stern said the PRNI had delivered 4,300 warnings — including some to foreign governments about targeted companies in their countries — and saved victims roughly $9 billion in economic damages.

For at least the past several months, Stern has been the only CISA employee staffing the PRNI. One source called him "absolutely critical to national security." Another source said the PRNI was "some of the most impactful work CISA does."

In a statement, CISA said the PRNI "has not stopped" and added that the agency continues to focus "squarely on executing its statutory mission," including "delivering timely, actionable cyber threat intelligence" to partners.

The PRNI may indeed still be operating. One source told me that CISA was preparing other employees to take over for Stern. But multiple sources said Stern brought unique value to the program that won't easily be replaced — potentially hampering it in the short term.

In particular, the PRNI relied on Stern's trusted relationships with independent experts and companies that tipped off CISA to imminent ransomware attacks. "Dave has relationships that won’t be portable to someone new," said one person familiar with the matter.