Cybersecurity Policy Report, Americans’ Indifference to Cyber Threats Weakens Preparedness, Rep. Green Says, (May 29, 2025)

By Tom Leithauser

The American people seem to lack awareness about the national security dangers lurking in cyberspace, which leads to public complacency about the need to address the threat, according to Rep. Mark Green (R., Tenn.), chairman of the House Homeland Security Committee.

“One of the things that shocks me is how uninformed the American people seem to be on just how pervasive the attacks against this nation are in cyberspace,” Rep. Green said at a committee field hearing held late yesterday at Stanford University.

Rep. Green cited the Salt Typhoon cyber espionage campaign orchestrated by the Chinese government to penetrate U.S. telecommunications networks, which caused an uproar in the cybersecurity community but, in his view, didn’t seem to enter public discourse more generally.

“Imagine if Russia placed a satchel charge next to a cell tower and had a detonator in their hand. We’d be livid. But essentially that’s exactly what China has done to our telecommunications systems,” he said.

“There’s no clamor about this,” Rep. Green said. “They literally have a kill switch in the system right now, and nobody’s making a big deal out of it.”

“Why do you guys think that’s the case?” he asked the witnesses at the hearing.

H.R. McMaster, a senior fellow at Stanford’s Hoover Institution, suggested that the American public hadn’t been warned that cyber operations were part of China’s preparations for war.

“The Chinese Communist Party is preparing for war in a number of ways. We see it with the massive buildup of their military forces,” Mr. McMaster said. “I think what we can do is connect what we’ve seen with Salt Typhoon to a broader range of threats, including the massive buildup of their nuclear forces.”

“We haven’t really taken this to the American people to explain the gravity of it,” he added. “The American people really haven’t had this explained in context.”

“In addition to lack of awareness, one of the things that we unfortunately do today is punish the victims” of cyber attacks, Wendi Whitmore, Palo Alto Networks, Inc.’s chief security intelligence officer, told the committee.

Banks aren’t generally blamed when they’re robbed by an armed criminal, Ms. Whitmore noted, but successful cyber attacks lead to questions about the victim’s preparedness.

“And then we add regulation in that requires them to provide information” to the public and government during the “dynamic time period” after a cyber intrusion, she said.

“So you have a victim who is now potentially trying to negotiate with or have communications with an attacker. They’re working with law enforcement. They’re working with outside legal counsel, and they still don’t have all the technical details ... that are needed to fully answer these questions,” she said.

The hearing at Stanford, titled “Innovation Nation: Leveraging Technology to Secure Cyberspace and Streamline Compliance,” was held to hear from Silicon Valley experts and included a non-public roundtable discussion afterward.

In their written testimony, the witnesses offered a variety of recommendations to improve the nation’s cyber defenses.

Ms. Whitmore warned that the government and critical infrastructure needs to speed their adoption of quantum-resistant encryption. The National Institute of Standards and Technology has recommended a 2035 deadline for most federal agencies to adopt encryption tools that can’t be broken by a quantum computer (CPR, Nov. 12, 2024), but Ms. Whitmore suggested that 2035 would be too late.

“Adversaries are actively collecting our sensitive encrypted data today, fully intending to decrypt it within the coming years. Waiting until 2035 to achieve comprehensive quantum readiness will leave a significant window of vulnerability, jeopardizing classified information and the personal data of American citizens,” she testified.

Jeanette Manfra, Google Cloud’s global director–security and compliance, advocated for the harmonization of federal cyber regulations.

“Regulations must prioritize tangible outcomes over mere checklist compliance,” Ms. Manfra said. “We urge Congress to modernize cybersecurity regulations and create a stable baseline that existing sectors can adhere to and future sectors can adopt as a reliable guide for improving security and resilience.”

Jack Cable, chief executive officer of Corridor Security, Inc., called for a continued emphasis on “secure-by-design” principles that have been championed by the Cybersecurity and Infrastructure Security Agency, where he previously worked as a senior technical adviser.

“The vast majority of cyberattacks take advantage of either a preventable software vulnerability or an insecure default configuration,” Mr. Cable noted. “Rather than placing the burden on end-users to take care of these problems, software manufacturers can build their products to be secure by design and thus raise costs on our adversaries.”

MainStory: TopStory FederalLegislation DataSecurity