CISA

OLYMPUS opened an institutional file on CISA because it is the one agency in this drawer that holds two seats at once. By statute it is a cyber-defense agency: it writes the binding directives federal civilian networks must obey and it is the recipient Congress named for critical-infrastructure incident reports. By record it was also, until mid-2022, the government end of a content-reporting channel to the social-media platforms, and its own director described the object of that work as “cognitive infrastructure.” An agency has no Big Five and no Dark Triad, and the unit does not invent them; what an agency has is a statute, a budget line and a paper trail, and those are the file. Part of the paper trail is a court’s: a federal appeals court found in 2023 that the agency likely violated the First Amendment, the Supreme Court reversed on standing in 2024, and nothing on the merits has been decided since.

Institutional Archetype

THE SWITCHBOARD — CISA is the government end of a pipeline built so that no call is ever a direct order. A federal cybersecurity agency spots a social-media post it considers misleading, and instead of contacting the platform — which would be state action, and state action against speech is unconstitutional — it routes the flag to an academic intermediary, which analyzes it, which forwards a recommendation to the platform, which acts. The government’s preferred outcome is achieved; at no node did the government technically direct a takedown. The switchboard’s value is precisely that separation: it makes the current flow while keeping every operator able to say, truthfully, that they did not do the thing the system was built to do. This profile scores the position — the state seat at the head of a laundering pipeline, and the agency that formally reclassified true information as a threat — not the motives of any officer who sat in it.

Mandate & Origin

CISA — the Cybersecurity and Infrastructure Security Agency — was established on 16 November 2018, when President Trump signed the Cybersecurity and Infrastructure Security Agency Act of 2018, reorganizing the DHS National Protection and Programs Directorate (NPPD) into a standalone agency. Its statutory mission is critical-infrastructure security: it brands itself “America’s Cyber Defense Agency,” charged with defending federal networks and the sixteen critical-infrastructure sectors — power grids, water treatment, elections administration — against cyberattack. Its first director was Christopher Krebs (fired by tweet in November 2020; the person is drama, treated elsewhere, and not re-litigated here). The relevant expansion came under director Jen Easterly, who from 2021 staffed a team to monitor online “disinformation” as part of what she termed the nation’s “cognitive infrastructure.”

The text of the charter. The enacted statute is short on what the agency is for and silent on what it later did. Pub. L. 115-278 provides that “The Agency shall be headed by a Director of Cybersecurity and Infrastructure Security,” who “shall report to the Secretary” of Homeland Security, and that the Director shall “lead cybersecurity and critical infrastructure security programs, operations, and associated policy for the Agency” (Pub. L. 115-278, section 2202). The words “misinformation,” “disinformation” and “election” appear nowhere in the enacted text. Election systems entered the mandate by a different instrument: on 6 January 2017 DHS Secretary Jeh Johnson designated election infrastructure a subsector of the Government Facilities sector and wrote that the designation “does not mean a federal takeover, regulation, oversight or intrusion concerning elections in this country” (DHS statement). The agency’s own mission line today is “We lead the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure” (CISA, About).

The mandate is the tell. Protecting water plants from hackers is a cyber-defense function. Monitoring domestic speech about election procedures, vaccine efficacy, and COVID origins is not — yet that is where the “cognitive infrastructure” line carried the agency. CISA’s own Mis-, Dis-, and Malinformation (MDM) materials define malinformation as information “based on fact, but used out of context to mislead, harm, or manipulate.” A cybersecurity agency had formally entered true information into the threat catalogue. That category did not exist in its 2018 charter; it materialized because infrastructure built for one purpose acquired capabilities that exceeded the justification.

Funding & Backers

CISA is a federal agency, funded by Congressional appropriation (on the order of $3 billion/year), not by outside grantmakers — which distinguishes it from the NGO layer of the flagging machine it fed. The money flows the other direction: CISA sat at the government end, and federal grant dollars flowed out through the ecosystem it worked with — the Election Integrity Partnership, created in summer 2020 “at the request of” CISA, led by the Stanford Internet Observatory with the University of Washington’s Center for an Informed Public, Graphika and the Atlantic Council’s DFRLab as partners. CISA is thus not a funder in this file; it is the demand side — the state customer whose content preferences the grant-funded intermediaries processed through a Jira ticketing system.

The budget line, in DHS’s own tables. The Department’s FY2027 budget justification for CISA shows the agency at 3,732 positions, 3,294 full-time equivalents and $2,873,008 thousand in the full-year continuing resolution for FY2025 and the annualized continuing resolution for FY2026, and at 2,865 positions, 2,528 FTE and $2,487,194 thousand in the President’s FY2027 request, a change of 867 positions, 766 FTE and $385,814 thousand (DHS, FY2027 CISA budget justification). The same document lists the cut that matters to this file: “The FY 2027 Budget includes a decrease of 14 Positions, 14 FTE, and $39.6M from the Election Security Program,” so that “the Election Security Advisors (ESAs) in each of the ten CISA Regions who act as liaisons between CISA will be eliminated and cooperative agreement funding for the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC) will not be renewed,” on the justification that “CISA will continue to focus on its core mission areas and adapt to evolving policy direction.” Secretary Markwayne Mullin gave the Department’s framing to the Senate Appropriations Subcommittee on Homeland Security on 2 June 2026: “The Budget restores CISA to its original mission of securing cyberspace and protecting critical infrastructure,” and “The $2.5 billion request for CISA advances the Administration’s objectives” (Mullin testimony). The agency also draws on a second kind of backer, the industry partners in its Joint Cyber Defense Collaborative, which CISA “established … to unify cyber defense capabilities from government, industry and international organizations” (CISA, JCDC).

Institutional Voice & Intent

The voice is two registers, and the agency has used each on the other’s subject. The first is the vulnerability-bulletin register, flat, dated and imperative: “Remediate each vulnerability as quickly as possible and no later than the timelines set forth in Table 1: Remediation Timelines” (BOD 26-04, 10 June 2026). The second is the register of the former director on 10 November 2021: “One could argue we’re in the business of critical infrastructure, and the most critical infrastructure is our cognitive infrastructure, so building that resilience to misinformation and disinformation, I think, is incredibly important” (quoted in the House Judiciary staff report, 26 June 2023). Sixteen months later, on 28 March 2023, the same director told Congress, as the same report quotes her: “we don’t flag anything to social media organizations at all. We are focused on building resilience to foreign influence and disinformation.” The report sets beside it the Department’s inspector general, who recorded that CISA began “notifying social media platforms or appropriate law enforcement official when voting-related disinformation appeared in social media” as early as 2018, and the deposition of the head of CISA’s MDM team, who confirmed that CISA had flagged content to platforms in the process called switchboarding. The Supreme Court’s own account, in an opinion that decided nothing about the merits, reads: “Until mid-2022, CISA, through its ‘switchboarding’ operations, forwarded third-party reports of election-related misinformation to the platforms” (Murthy v. Missouri, 603 U.S. ___ (2024)). The agency’s switchboarding emails carried a disclaimer that the Court quotes: CISA “w[ould] not take any action, favorable or unfavorable, toward social media companies based on decisions about how or whether to use this information.”

Stated intent: Cyber defense and infrastructure resilience: “We lead the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure.” On the information work, the agency’s advisory committee wrote in June 2022 that its recommendations “are specifically designed to protect critical functions from the risks of MD, while being sensitive to and appreciating the government’s limited role with respect to the regulation or restriction of speech” (CISA Cybersecurity Advisory Committee, June 2022).

Observed intent: Hold the one federal seat from which election officials, platforms and the research community could be connected. The agency convened the platforms before the 2020 election and the 2022 midterms, forwarded election officials’ reports of “misinformation” to them, and, by the Fifth Circuit’s finding, told platforms “whether the content they had ‘switchboarded’ was true or false.” After the litigation it moved the function: the House report, citing the deposition, says CISA “transferred the ‘switchboard function’ to the EI-ISAC” for 2022.

Gap, with the defense at full strength. The agency’s case, steelmanned from its own record: the election offices it serves are, in the EIP report’s count, “almost 10,000” and decentralized; the 2017 designation offered help “only for those who request it”; the reports it forwarded came from those officials, not from CISA; its disclaimers said no action would follow either way; the advisory committee named the First Amendment in the introduction to its recommendations; and the Court’s syllabus records that “the platforms had independent incentives to moderate content and often exercised their own judgment.” Against that, the Fifth Circuit’s reading of the same record: “CISA’s role went beyond mere information sharing.” The director testified in March 2023 that the agency flags nothing to platforms; the Department’s inspector general, the MDM team lead’s deposition and the switchboarding emails record that it forwarded reports. The record does not settle whether the switchboard was an information service or a lever, because no court reached the merits. For the switchboard it never needs to: the page scores the position, and the position was a government seat between the reporter and the platform.

Interest: What each position pays, documented, with the best case its holders state. The positions are the agency’s, the Department’s and their critics’; the person who set the agency’s information-work posture, Jen Easterly, has no file on this site, and her words appear above only as the quoted record has them.

• Make incident reporting to CISA mandatory (CIRCIA). Position: the agency’s own statement of the statute, that CIRCIA “requir[es] the Cybersecurity and Infrastructure Security Agency (CISA) to develop and implement regulations requiring covered entities to report covered cyber incidents and ransomware payments to CISA,” and the agency’s own page records the statutory clocks, “no later than 72 hours from the time the entity reasonably believes the incident occurred” (CISA, CIRCIA). What it pays: the agency becomes the single federal recipient of incident and ransomware-payment reports across the critical-infrastructure sectors, which the agency describes as the means “to rapidly deploy resources and render assistance to victims suffering attacks, analyze incoming reporting across sectors to spot trends, and quickly share that information with network defenders.” The seat is not yet paid: “multiple funding lapses impacted CISA’s ability to conduct rulemaking activity for CIRCIA. CISA continues to work on the final rule,” and reporting “will not be required until the CIRCIA final rule goes into effect” (same page; the proposed rule was published at 89 FR 23644 on 4 April 2024). Best case, the agency’s own: faster assistance to victims and cross-sector trend detection. Convergence: none documented in the sources read; the covered entities are the parties the reporting duty would bind, and the final rule that defines them is not issued.
• Keep the binding-directive power. Position: the agency’s statement that “Federal agencies are required to comply with DHS-developed directives” (CISA, Directives) and that 44 U.S.C. 3553(b)(2) “authorizes the Secretary of the Department of Homeland Security (DHS) to develop and oversee the implementation of binding operational directives” (BOD 26-04). What it pays: CISA’s Known Exploited Vulnerabilities Catalog, established under BOD 22-01 in 2021, drives the remediation timelines of every federal civilian agency, and the agencies report their status to CISA through the Continuous Diagnostics and Mitigation dashboard or, where they have not automated it, “on a bi-weekly basis”; BOD 26-04 “supersedes and hereby revokes BOD 19-02 … and BOD 22-01” and “consolidates and clarifies vulnerability remediation guidelines for federal agencies.” The directive “do[es] not apply to statutorily defined ’national security systems’ or to certain systems operated by the Department of War or the Intelligence Community.” Best case, the directive’s: “Cyber threat actors exploit unpatched vulnerabilities, and their use of AI may further narrow the time defenders have to react between patch release and possible exploitation.” Convergence: none documented beyond the agencies directed, who carry the cost of compliance and, on the directive’s text, hold no seat in the catalog decision.
• Treat election systems as critical infrastructure, then stop treating them as one. Position, 2017: Secretary Johnson’s designation, made so DHS can “prioritize our cybersecurity assistance to state and local election officials,” and offered to “those who request it.” Position, 2026: the Department’s request to end the regional election security advisers and the EI-ISAC agreement while “restor[ing] CISA to its original mission.” What the first paid: a standing federal partnership with election offices and a funded nonprofit conduit to them, the EI-ISAC the House report calls “CISA-funded.” What the second pays: the same request “transfers many of the Countering Weapons of Mass Destruction Office’s current functions to CISA, including its policy, research and development, biosurveillance … and Federal assistance programs, such as Securing the Cities and BioWatch” (Mullin testimony), so the agency loses an election program and gains a weapons-of-mass-destruction program in the same document. Best case, the Department’s: the agency’s charter never mentioned elections or information content. Best case for the other side, the agency’s former advisory committee’s own: pervasive information disorder “diminishes trust in information, in government, and in the democratic process more generally.” Convergence: the nonprofit that ran the EI-ISAC lost the funding stream, as the Wisconsin Elections Commission records: “DHS announced the immediate termination of federal funding for all election-related activities, including personnel and EI-ISAC services” (Wisconsin Elections Commission memo, 19 March 2025).

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

CISA sits in the apparatus as the federal node the other nodes were built to reach. The nonprofit Center for Internet Security ran the EI-ISAC that gave local election officials one place to report; the Election Integrity Partnership’s own report describes it: “the EI-ISAC served as a singular conduit for election officials to report false or misleading information to platforms,” with CISA’s Countering Foreign Influence Task Force aiding “in the reporting process” (EIP, The Long Fuse). The Election Integrity Partnership gave the same reports an analytic layer, run by Stanford Internet Observatory, the University of Washington’s Center for an Informed Public, Graphika and DFRLab, and the Virality Project carried the model to health claims. CISA’s own advisory committee ran an MDM subcommittee chaired, per the House report, by Kate Starbird of the Center for an Informed Public (see Kate Starbird). The adjacent seats are the Global Engagement Center at State, which the House’s November 2023 report names beside DHS, and the FBI, with which the Fifth Circuit found CISA “worked in close coordination” on platform policy. Apart from the two agencies, every one of those nodes was nonprofit or academic, and the enacted CISA text carries no provision for this work. The design is the finding: a federal seat at one end, private seats at the rest.

Actions & Leadership Choices

The PR register is “protecting critical infrastructure.” The deeds, read end to end, describe a state switchboard for content flagging operated in the vocabulary of cybersecurity — and the deeds support the switchboard frame the archetype names.

• It built a dedicated channel into the platforms. Per the House Judiciary staff report, CISA coordinated directly with platforms on content, and Facebook stood up a special government portal for CISA to submit flags. The committee titled its account “The Weaponization of CISA: How a ‘Cybersecurity’ Agency Colluded with Big Tech” — the committee’s characterization, not a court finding.

• It ran a “switchboard” through an intermediary rather than call the platform itself. The EIP pipeline — government flags in, academic analysis, platform-facing recommendations out — is the switchboard in operation. CISA’s defenders note it never held a delete button; that is the point of the design, not a mitigation of it.
• It reclassified true information as a threat. The MDM “malinformation” definition — “based on fact, but used out of context” — is CISA’s own published language. The Virality Project, extending the same pipeline to COVID content, flagged “stories of true vaccine side effects” as actionable. The category and the pipeline were CISA-adjacent infrastructure whose scope expanded from foreign disinformation to domestic misinformation to true-but-inconvenient information, with no reverse gear. The Virality Project’s own July 2021 memo recommended that a federal Center of Excellence for mis- and disinformation be “housed in the Department of Homeland Security’s CISA” (Virality Project); the memo is a recommendation, and no CISA response is asserted.

• When the courts finally looked, they declined to rule. In Murthy v. Missouri (2024), the Supreme Court documented extensive CISA-and-FBI-to-platform contacts but held 6–3 that plaintiffs lacked standing; Alito’s dissent called it “one of the most important free speech cases to reach this Court in years.” Whether CISA’s jawboning violated the First Amendment remains unadjudicated. The infrastructure was dismantled — CISA’s MDM team was reorganized in 2025 under the Trump administration, and the agency later shed more than a third of its staff — but no court found it unlawful. The switchboard was unplugged by politics, not by a ruling.

Leadership choices. The agency that added “cognitive infrastructure” to a cyber-defense charter did so under its own directorate, not by external capture — the expansion was a leadership choice, made in-house, defended in Congressional testimony, and reversed only when the administration changed. The switchboard is not a program CISA fell into; it is one it built.

The courts’ words on CISA. Two federal courts have written about this agency’s conduct and neither judgment stands. The Fifth Circuit, on 3 October 2023, found that “CISA’s role went beyond mere information sharing,” that “CISA officials affirmatively told the platforms whether the content they had ‘switchboarded’ was true or false,” and concluded: “Thus, CISA likely significantly encouraged the platforms’ content-moderation decisions and thereby violated the First Amendment” (Missouri v. Biden, No. 23-30445). That was a preliminary-injunction finding of likelihood, not a final judgment. The Supreme Court reversed on standing and wrote that the Fifth Circuit “held that the CDC and CISA significantly encouraged (but did not coerce) the platforms’ moderation decisions”; its own summary of CISA’s conduct is the sentence quoted under Voice & Intent, and its treatment of the one plaintiff who tied his posts to a CISA document is specific: “The spreadsheet shows that a private entity, the Election Integrity Partnership–not CISA–alerted Twitter to an unidentified article from the Gateway Pundit” (Murthy v. Missouri). On remand the Fifth Circuit “VACATE[d] the judgment of the district court and the preliminary injunction in their entirety” on 26 August 2024 (order). So the record has a finding of likely violation, a reversal without a merits ruling, and a specific evidentiary point on the plaintiff’s side of the ledger that the Court read against him.

The Election Integrity Partnership, from both ends. The House’s November 2023 report states the origin as: “Created in the summer of 2020 ‘at the request’ of the Cybersecurity and Infrastructure Security Agency (CISA),” citing a 31 July 2020 email from an Atlantic Council employee (House Judiciary, 6 November 2023). The partnership’s own report gives a different sequence: “The initial idea for the Partnership came from four students that the Stanford Internet Observatory (SIO) funded to complete volunteer internships at the Cybersecurity and Infrastructure Security Agency (CISA),” and then “in consultation with CISA and other stakeholders, a coalition was assembled”; it adds that “none of these federal agencies has a focus on, or authority regarding, election misinformation originating from domestic sources within the United States,” and that CISA’s Countering Foreign Influence Task Force “aided in the reporting process” (EIP, The Long Fuse). Its acknowledgments name Craig Newmark Philanthropies, the William and Flora Hewlett Foundation, the Omidyar Network and the Atlantic Council as funders, with partial National Science Foundation support for some contributing researchers. Both accounts are on the record; neither is a finding that CISA directed the partnership.

From CISA to the Observatory. CyberScoop reported in December 2020 that Matt Masterson, “a senior adviser at the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency since 2018,” “will join the Stanford Internet Observatory,” with his last CISA day on December 18 (CyberScoop). Stanford lists him as a “former non-resident policy fellow with the Stanford Internet Observatory” (Stanford FSI). With three Observatory colleagues he co-authored the Virality Project memo recommending “a federal Center of Excellence for mis- and disinformation housed in the Department of Homeland Security’s CISA” (Virality Project).

The portal that was discussed. The House’s November 2023 report documents that from January 2020 CISA officials and the Center for Internet Security discussed a “misinformation reporting portal,” that a CIS email described it as intended “to manage the reporting of election infrastructure misinformation from local and state election officials to the social media platforms,” and that a CISA official wrote to Facebook employees in April 2020: “The idea is to establish a centralized portal for reporting disinformation or other issues on platforms so that election officials only have one place to go to report.” By May the planning had, in the report’s words, “hit a roadblock,” and the report quotes call notes that “DHS cannot openly endorse the portal.” The report’s reading is that the EIP then served the same purpose.

The reorganization, in DHS’s words. On 12 February 2025 a DHS spokesperson said the agency was evaluating how it had executed its election security mission and that “personnel who worked on mis-, dis-, and malinformation, as well as foreign influence operations and disinformation, have been placed on administrative leave” (Nextgov). The funding followed: the Wisconsin Elections Commission recorded that “On February 19, 2025, DHS announced the immediate termination of federal funding for all election-related activities, including personnel and EI-ISAC services,” and that on 6 March “all federal funding was cut for the Election Infrastructure Information Sharing and Analysis Center” and the multi-state center, while CIS “confirmed that these services continue uninterrupted while it explores how to support this work without federal funding” (Wisconsin Elections Commission). The FY2027 request then writes the end of the regional election advisers into the budget (see Funding & Backers). The agency’s own leadership page lists Nick Andersen as “Acting Director” (CISA, Leadership).

The statutory work that continued. CISA’s cyber-defense function did not pause. On 10 June 2026 it issued BOD 26-04, which revoked the 2021 catalog directive and consolidated federal remediation rules, and its CIRCIA page states: “While CISA recognizes the importance of CIRCIA, multiple funding lapses impacted CISA’s ability to conduct rulemaking activity for CIRCIA. CISA continues to work on the final rule.” The four town halls on the rule were held 15 to 18 June 2026 (CISA, CIRCIA). By the page’s own account CIRCIA “required CISA … to issue a final rule setting forth the regulatory requirements within 18 months of the publication of the NPRM,” which ran from April 2024, and the page records no final rule.

CONDUCT verdict: STATE-JAWBONE — LAUNDERED CONTENT FLAGGING. A statutory cyber-defense agency that opened a direct channel to platforms, routed government content preferences through a grant-funded academic intermediary so no takedown was ever technically ordered, and formally entered true information into its threat catalogue as “malinformation.” The work was defended as lawful information-sharing; the Supreme Court declined to rule on the merits; the apparatus was dismantled administratively in 2025. The mechanism was legal until a court said otherwise, and no court did. The switchboard is the finding, not the officer.

Alliance Map

These run at the same time, and the overlap is the finding. In 2020 the agency was at once the statutory partner of the election offices, a stakeholder of a coalition that included two ratchet organizations, the convener of platform meetings, the funder of the nonprofit conduit that received the reports, and, from 2022, the host of an advisory subcommittee drawn from industry and academia. Each tie is documented in a record produced by a court, a congressional committee, the coalition itself or the agency; none is a coordination claim, and the courts that looked decided only standing.

Reach Assessment

Institutional: High on the compulsory side, narrow in what it compels. A binding operational directive reaches every federal civilian agency, with dates, reporting through a CISA dashboard and an annual report to three principals; the reporting rule that would extend a mandatory duty to private covered entities has been in rulemaking since April 2024 and is not final. Beyond the federal civilian networks the agency’s reach is convening: the Joint Cyber Defense Collaborative, the election offices that ask for assistance, and until 2025 the funded nonprofit conduit that connected them to the platforms. Memetic: The agency’s one memetic act was a definition. In June 2022 its advisory committee defined malinformation as “information that may be based on fact, but used out of context to mislead, harm, or manipulate,” and the phrase is the one the argument about whether a government may label true speech a threat keeps returning to; the same document states its own limit, “the government’s limited role with respect to the regulation or restriction of speech.” Civilizational: The cyber-defense side is load-bearing for networks no argument about speech touches, which is why the agency can be cut without the programs it serves going away. The speech side shows how cheap an in-house switchboard is to build and to unplug: set up under one administration without a statute that mentions it, ended under the next by an administrative leave and a budget line, reviewed by two courts and decided on neither’s merits. The precedent is the seat, not the officer.

Sources: CISA — About (Wayback); CISA — Foreign Influence Operations and Disinformation; CISA — Disinformation Stops With You (infographic set) (Wayback); House Judiciary — CISA Staff Report, “The Weaponization of CISA” (PDF); House Judiciary — New Report Reveals CISA Tried to Cover Up Censorship Practices; The Intercept — Leaked Documents Outline DHS’s Plans to Police Disinformation (Klippenstein & Fang); Supreme Court — Murthy v. Missouri, No. 23-411 (PDF); DHS OIG — DHS Needs a Unified Strategy to Counter Disinformation, OIG-22-58 (PDF); Cybersecurity and Infrastructure Security Agency — Wikipedia; Cybersecurity and Infrastructure Security Agency Act of 2018, Pub. L. 115-278 — govinfo; Missouri v. Biden, Fifth Circuit, 3 Oct 2023; Missouri v. Biden, Fifth Circuit order on remand, 26 Aug 2024; House Judiciary — The Weaponization of “Disinformation” Pseudo-Experts and Bureaucrats, 6 Nov 2023 (PDF); Election Integrity Partnership — The Long Fuse (PDF); CISA Cybersecurity Advisory Committee — MDM recommendations, June 2022 (PDF); DHS — FY2027 Congressional Budget Justification, CISA (PDF); DHS Secretary Mullin — FY2027 budget testimony, 2 June 2026 (PDF); CISA — BOD 26-04; CISA — Directives; CISA — CIRCIA; CISA — Joint Cyber Defense Collaborative; CISA — Leadership; DHS — Statement by Secretary Johnson on the designation of election infrastructure, 6 Jan 2017; Wisconsin Elections Commission — Election Security Updates memo, 19 Mar 2025 (PDF); Nextgov — CISA staff focused on disinformation put on leave, 12 Feb 2025; Center for Internet Security — EI-ISAC.