Experts back integrated State Department cyber bureau

The future of the State Department Bureau of Cyberspace and Digital Policy is in flux as the Trump administration prepares to demote the bureau and split its functions under an agency-wide reorganization plan.

But wherever it ends up on the State Department organizational chart, foreign affairs experts say the bureau should remain an integrated unit that oversees international cybersecurity and broader digital economy issues.

The CDP bureau currently reports directly to the deputy secretary of state.

But under the reorganization plan unveiled by Secretary of State Marco Rubio last week, the bureau would be split up. The ambassador-at-large for cyberspace and digital Policy, along with the bureau’s existing economic team, would report to the undersecretary for economic growth, energy and environment.

Meanwhile, the bureau’s cybersecurity team would report to a newly created Bureau of Emerging Threats, which would fall under the undersecretary for arms control and international security.

During an April 29 House Foreign Affairs Europe subcommittee hearing, Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, testified that CDP “should report directly to senior officials in the department and not through layers of deputies and assistant secretaries.”

She said Rubio’s proposed reorganization “appears to put its cybersecurity efforts at risk and contradict Congressional guidance to integrate cybersecurity and digital economy efforts.”

The cyber bureau is just one piece of a broader reorganization plan that Democrats have heavily criticized.

“This plan undermines the core reason CDP was created again — streamlining international cyber policy,” Rep. Gabe Amo (D-R.I.) said during the hearing. “It is not efficient to create overlapping and redundant mandates. It is not efficient to jeopardize how CDP coordinates cyber policy with the Department of Defense, Homeland Security, and the intelligence community.”

Republicans have tacitly supported the Trump administration’s plans, but are pushing to have their say through a long-awaited State Department reauthorization process. Congress has not passed a standalone State reauthorization bill since 2002.

The Biden administration created the cyber bureau in 2022 to elevate its cybersecurity efforts and consolidate cyber-related activities into one unit. Congress later authorized some of its activities as part of the fiscal 2023 defense authorization bill. The bureau was led by the first Ambassador-at-Large for Cyberspace and Digital Policy, Nathaniel Fick, from 2022 through this past January.

Fixler said a key area where the bureau aligns U.S. foreign policy and technology goals is the provision of cyber-related foreign aid. She pointed to CDP’s decision to prioritize the security of undersea cables.

“When CDP is able to get involved, it can use a little bit of foreign assistance, find U.S. partners and allies who are interested in the issue, and then combine that with the private sector investment,” Fixler said. “So we look at it from a strategic perspective and we don’t just focus on the market, but also on where it matters for U.S. military capabilities, particularly in the Indo-Pacific. But that is applicable in other areas as well.”

The cyber bureau has also sought to add tech experts to U.S. embassies across the world.

Latesha Love-Grayer, director of International Affairs and Trade at the Government Accountability Office, said the development and recruitment of officials with both tech expertise and diplomatic skills has been a key challenge for the bureau.

“It’s very hard to compete with the private sector for individuals who can harness both of those skill sets,” Love-Grayer said during the April 29 hearing. “And so having the staff, if you get them on board, keeping them and helping them to grow and understand the issues is important, but also having staff who can really cover the broad spectrum of issues that are involved in cyber diplomacy.”

Asked specifically about the reorganization plan, Fixler said the key is integrating “different components of the cyber mission, the digital economy mission, and the emerging threats mission.”

“I think the integration of the Bureau is where I would focus,” Fixler said. “Where you position the bureau I think may be less important than the integration of the different capabilities within the bureau.”

Love-Grayer agreed, but argued the reporting structure is key as well.

“I think that integration is really critical even as we interface with other governments who are structured differently,” Love-Grayer said. “However, I do think that where it sits plays an important role as well because depending on where it sits it may have to compete with resource or compete with others for resources. And it also needs the ability to have the leader communicate with the most senior leaders at State in order to make some pretty important decisions.”

Experts also emphasized the need for competent State Department technology policies with the mounting international competition over artificial intelligence and related technologies.

“I very much agree with the point about maintaining integration,” Theodore Nemeroff, former senior advisor at the National Security Agency and co-founder of Verific AI, said during the hearing. “I think you need to make sure that whoever it’s reporting to cares about the whole mission and that senior leaders at the top of the department, the deputy secretary, are still going to be representing all the equities at deputies committee meetings and diplomatic engagements.”