Cybersecurity Policy Report, Federal Courts Should Be Forced to Adopt Basic Cyber Defenses, Wyden Says, (Oct 6, 2025)
Congress should require the federal judiciary to adopt the same cybersecurity standards as the executive branch based on its refusal to adopt modern cyber defenses, according to Sen. Ron Wyden (D., Ore.).
“Even after back-to-back catastrophic hacks of the federal court system, Chief Justice [John Roberts] continues to stonewall Congress and cover up the judiciary's gross negligence that has enabled these hacks,” Sen. Wyden said in a statement e-mailed today to CPR.
“It is long past time for the courts to follow the same minimum cybersecurity standards as the executive branch, but since Chief Justice Roberts and the Judicial Conference refuse to set such requirements, Congress must step in and legislate,” he said.
Sen. Wyden was responding to a letter he received from Robert Conrad, director of the Administrative Office of the U.S. Courts.
In the Sept. 30 letter, which Sen. Wyden released today, Mr. Conrad disputes the senator’s assertions, expressed in an earlier letter to Chief Justice Roberts, that security failures in federal court systems had been allowed to “fester for decades” (CPR, Aug. 25).
Sen. Wyden sent the August letter following reports that federal court systems, including PACER (Public Access to Court Electronic Records) and case management/electronic case files (CM/ECF), had been hacked (CPR, Aug. 8).
“Although in your letter you state, ‘[w]hile the judiciary has solicited advice from leading government experts on establishing a modern, secure and efficient case management system, the judiciary thus far has ignored that advice and has made no meaningful progress towards a replacement,’ this is simply not the case,” Mr. Conrad told the senator.
The administrative office (AO) “remains at work in modernizing CM/ECF to bring it in line with current technology practices. Substantial planning for the modernization effort began in 2022, and we are now approaching the development and implementation phase of the project. We expect implementation will begin in the next two years in a modular and iterative manner,” Mr. Conrad explained.
“On a parallel track with the modernization project, the Judiciary has taken numerous steps to improve our cybersecurity posture since 2021 (and not solely with regard to CM/ECF). We have implemented many patches and system updates, implemented multi-factor authentication (MFA) for all court staff, and are in the process of rolling out MFA to all five million PACER users in a phased implementation,” he said.
But the “diversity of users” of PACER presents “unique challenges in implementing MFA,” he added.
The legislation proposed by Sen. Wyden is likely to seek, among other things, an independent, expert review of the judiciary’s cyber defenses, which is what he called for in his August letter to Chief Justice Roberts.
News: FederalLegislation DataSecurity