Cybersecurity Policy Report, Federal Courts’ Cyber Failures Should Receive Independent Review, Wyden Says, (Aug 25, 2025)
The federal judiciary should arrange “an independent, public, expert review” of a recent cyber attack on its case management system and other security failures that have been allowed to “fester for decades,” Sen. Ron Wyden (D., Ore.) said today.
Sen. Wyden’s recommendation, offered in a letter to Chief Justice John Roberts, is a reaction to recent reports that hackers had breached federal courts’ case management and filing systems (CPR, Aug. 8).
The courts experienced a similar breach in 2021 (CPR, July 29, 2022), and the latest attack apparently exploited flaws that were discovered several years ago and left unpatched, Sen. Wyden noted.
“These serious problems in the judiciary’s approach to cybersecurity have been able to fester for decades because the judiciary covers up its own negligence, has no inspector general and repeatedly stonewalls congressional oversight,” he said.
Federal courts’ cybersecurity is overseen “by a committee of judges whose membership you have kept hidden from the public and who presumably have no technology expertise,” and the federal judiciary “has not adopted its own set of binding minimum cybersecurity standards,” which every federal court would have to follow, he told Chief Justice Roberts.
“Instead, each of the 94 federal district courts and 12 courts of appeals can choose to adopt good or bad practices,” he said. Executive branch agencies, for example, have been required since 2015 to use multi-factor authentication (MFA), a best practice that the judiciary only recently adopted, Sen. Wyden observed.
“The judiciary’s complete failure to address its cybersecurity problems after the 2020 breach, as well as the subsequent coverup and stonewalling of congressional oversight, makes it clear that the judiciary and its policymaking arm, the Judicial Conference, are ill-equipped to diagnose and address their own problems. An independent, public, expert review is essential not only because of repeated hacks, but also because of the judiciary’s subsequent lack of transparency,” he said.
“The courts have been entrusted with some of our nation's most confidential and sensitive information, including national security documents that could reveal sources and methods to our adversaries, and sealed criminal charging and investigative documents that could enable suspects to flee from justice or target witnesses,” he added. “Yet, you continue to refuse to require the federal courts to meet mandatory cybersecurity requirements and allow them to routinely ignore basic cybersecurity best practices.”
MainStory: TopStory FederalLegislation DataSecurity