Post

Scoop: The lone employee behind CISA's Pre-Ransomware Notification Initiative resigned on Friday rather than take a forced reassignment to FEMA. CISA says PRNI will continue, but sources said David Stern's loss will be a major setback for it. My story: www.cybersecuritydive.com/news/cisa-ra...

The PRNI, which launched in late 2022, is one of the most tactile ways in which CISA helps protect critical infrastructure organizations. When CISA gets intelligence from a partner about hackers prepping ransomware activity on a victim network, it alerts the victim.

In an interview with the SANS Institute in August, Stern said the PRNI had delivered 4,300 warnings — including some to foreign governments about targeted companies in their countries — and saved victims roughly $9 billion in economic damages.

For at least the past several months, Stern has been the only CISA employee staffing the PRNI. One source called him "absolutely critical to national security." Another source said the PRNI was "some of the most impactful work CISA does."

But shortly before the government shutdown began, Stern received one of DHS's Management Directed Reassignments (www.cybersecuritydive.com/news/cisa-la...), ordering him to take a FEMA job in Boston. He fought it for months but was eventually told to move or leave. So he quit on Friday.

In a statement, CISA said the PRNI "has not stopped" and added that the agency continues to focus "squarely on executing its statutory mission," including "delivering timely, actionable cyber threat intelligence" to partners.

The PRNI may indeed still be operating. One source told me that CISA was preparing other employees to take over for Stern. But multiple sources said Stern brought unique value to the program that won't easily be replaced — potentially hampering it in the short term.

In particular, the PRNI relied on Stern's trusted relationships with independent experts and companies that tipped off CISA to imminent ransomware attacks. "Dave has relationships that won’t be portable to someone new," said one person familiar with the matter.

The PRNI "depends entirely on tips from the cybersecurity researcher community," said another person, who added that Stern "had a fantastic relationship" with that community.

With Stern's ouster, some of CISA's partners in the PRNI are "reassessing how they want to engage with CISA," another source told me. It's the latest example of CISA's longtime allies in industry, academia, and beyond wondering if they can still count on the agency.

Read my full story on @cybersecuritydive.bsky.social: www.cybersecuritydive.com/news/cisa-ra...