DOGE's latest push to shrink the federal government is likely to have broad ramifications for the country's cyber defenses.

Why it matters: The Cybersecurity and Infrastructure Security Agency spearheads much of the government's efforts to protect U.S. critical infrastructure and federal agencies from foreign spies and hackers.

• Already, the Trump administration has cut contracts and attempted to jettison probationary CISA employees. But the latest round of cuts is likely to affect "every single part of the agency," a source familiar with the matter told Axios.

Driving the news: Yesterday, Homeland Security Secretary Kristi Noem offered DHS employees three options to voluntarily leave their roles, according to an email obtained by Axios.

• Employees have until the evening of April 14 to decide if they'll take an immediate buyout, deferred resignation or early retirement. CISA employees are among those who received the email.
• A senior DHS spokesperson said in a statement that "the American people deserve a government that works for them, something President Trump has promised."
• "Every dollar spent and position filled at DHS should be focused on our core mission of securing our homeland and keeping the American people safe," the spokesperson added.

The big picture: Cybersecurity workers across agencies have already been more distracted and overwhelmed than ever as the Trump administration overhauls the entire federal workforce.

Between the lines: Experts anticipated that at least some cuts would come to CISA during Trump 2.0, especially to the agency's election security work.

• But few anticipated that the entire agency would see broad cuts at the scale that's coming — even after the new chair of the Senate Homeland Security Committee said he wants to eliminate the whole agency.
• Last week, two sources familiar with the agency's plans told Axios that employees will likely receive "reduction in force" notices in the coming weeks if too few employees take the voluntary exit options.

What they're saying: Lawmakers and national security experts are already sounding the alarm about the cuts.

• Mark Montgomery, senior director at the Foundation for Defense of Democracies, told Axios that the latest personnel cuts "reek of indiscriminate actions."
• "Secretary Noem needs to put her chainsaw away and pull her scalpel out," said Montgomery, a former Senate Armed Services Committee and White House aide. "The cyber defense of our critical infrastructures demands a more nuanced approach."
• A spokesperson for Rep. Eric Swalwell (D-Calif.), ranking member of the House Homeland Security Committee's cyber panel, told Axios on Friday that the congressman has already requested a briefing with CISA about personnel cuts.
• Rep. Bennie Thompson (D-Miss.), ranking member of the House Homeland Security Committee, said the decision to push out CISA staff is "unpopular and politically foolish."
• "Eviscerating CISA's workforce is not only illegal, it tells our adversaries that it's open season on our networks and infrastructure. It's idiotic, irrational, and puts us all at risk," Thompson added.

Yes, but: Rep. Mark Green (R-Tenn.), chair of the House Homeland Security Committee, told Axios in a statement that the administration is "right to take steps to refocus CISA on its core mission — combating urgent cyber threats to our government networks and ensuring the resilience of critical U.S. infrastructure."

• Green also said his committee is ready to work with the administration to "identify the best path forward" to do so.

What to watch: It remains to be seen how many employees will take the exit options — or whether Sean Plankey, Trump's pick to lead CISA, will want to rebuild any of the teams and contracts that are being cut.

The surprise firing of the National Security Agency and Cyber Command's top leader last week may open the door for the Trump administration to split up the two agencies' long-shared leadership structure.

Why it matters: Detaching the military command could unleash its operatives for more offensive cyber strikes against foreign adversaries — and also risk crippling the country's own espionage efforts.

Driving the news: Gen. Timothy Haugh, who led the NSA and Cyber Command for a little over a year, was fired Thursday night with zero explanation — spurring outrage from lawmakers in both parties.

• The head of NSA and Cyber Command isn't a political appointee, and it's normal to see the same person lead these offices across several administrations.
• Haugh took over after Gen. Paul Nakasone retired following six years in the position.

The big picture: The NSA and Cyber Command have shared a director since the command was established in 2010.

• While the NSA is known for its spying and surveillance operations, the Cyber Command is a military unit that carries out a mix of offensive and defensive cyber operations.
• The two units typically need the same intelligence for their operations, and sharing leadership can help them figure out how best to weaponize that information.

Between the lines: Experts say Haugh's firing will make it easier to split up the dual-hat structure and de-shackle Cyber Command from the country's intelligence-gathering operations.

• Proponents of the split argue that Cyber Command has become too big on its own to have to share a leader with a similarly large organization.
• Some also argue that Cyber Command isn't able to carry out as many offensive strikes over fears that doing so will burn whatever covert operations the NSA is carrying out on adversarial networks.
• "NSA intelligence operations tend to be quiet, we don't want to get caught," Jason Healey, a senior research scholar at Columbia University's School of International and Public Affairs, told Axios. "Whereas in a military operation, the spirit of the bayonet is to kill, it's to get involved with the adversaries."

Zoom out: Offensive cyber strikes are a major priority for the second Trump administration.

• National security adviser Mike Waltz has advocated for the U.S. to "start going on offense" in cyberspace — and so has the Pentagon's acting chief information officer.
• Advisers to the Trump transition team were already working on a proposal for splitting up the dual-hat structure in December, according to The Record.

Yes, but: Divorcing the two offices could be "disastrous" because of the heavy intelligence-sharing relationship, Jake Williams, a former NSA hacker and faculty member at IANS Research, told Axios.

• "It's something that will get reversed, but probably only after an intelligence failure," Williams said.

What to watch: Splitting up the dual hat would require lawmakers' buy-in.

• In a letter to President Trump yesterday, several Democratic senators warned that "premature termination of the dual-hat arrangement would severely degrade the speed and effectiveness" of NSA and Cyber Command and could "have dire consequence for our national security."
• Lt. Gen. William Hartman, the new acting head of Cyber Command, will testify before the Senate Armed Services Committee tomorrow about the command's future.

Escalating U.S.-China trade tensions are likely to fuel a surge in Beijing-backed cyber espionage, a top security executive warns.

Why it matters: U.S. companies and government agencies were already grappling with an unprecedented wave of hacking activity linked to the Chinese government.

• New tariff threats could intensify that pressure.

Driving the news: Yesterday, President Trump threatened to impose an additional 50% tariff on Chinese goods starting Friday. The warning followed Beijing's move to implement its own 34% retaliatory tariff.

• "All talks with China concerning their requested meetings with us will be terminated until such time as the tariffs are removed," Trump said.

Threat level: The escalation gives Chinese operatives a stronger incentive to gather intelligence from U.S. politicians and global companies about how seriously to take the tariff threats, Levi Gundert, chief security and intelligence officer at Recorded Future, told Axios.

• "There will be a premium put on very timely information that helps them navigate this new era," he said.
• The volume of China-backed espionage targeting U.S. entities is already at record levels.
• Gundert said Beijing will likely also intensify efforts against governments and companies in other countries that are also negotiating new tariff deals with Trump.

Between the lines: Spying on sensitive political and economic discussions has long been a core objective of Chinese cyber operations. Gaining insights into tariff talks would fall squarely within Beijing's typical spying domains, Gundert said.

Flashback: Just last fall, U.S. officials found evidence that China had spied on the phones of American politicians — including Trump's.

What's next: Cybercriminals are also likely to exploit the confusion around tariffs with phishing campaigns and other scams, Gundert said.

@ D.C.

👨🏻‍💻 DOGE is hosting a hackathon in D.C. this week with the hopes of creating a single "mega API" to access IRS data. (Wired)

🪙 The Justice Department said in a memo that it's disbanding its National Cryptocurrency Enforcement Team and will "no longer target virtual currency exchanges, mixing and tumbling services, and offline wallets for the acts of their end users." (ABC News)

📲 Last month's Signal scandal started after national security adviser Mike Waltz accidentally accepted a "contact suggestion update" on his phone to save Atlantic editor-in-chief Jeffrey Goldberg's phone number under the wrong name. (The Guardian)

@ Industry

🚕 Waymo is preparing to use video from its robotaxis' interior cameras to train generative AI models, according to an unreleased version of its privacy policy. (TechCrunch)

🤖 OpenAI appears to be testing a watermark for free images generated using ChatGPT. (BleepingComputer)

💰 OpenAI also co-led a $45 million funding round in AI cybersecurity company Adaptive Security. (CNBC)

@ Hackers and hacks

👀 Oracle acknowledged to customers that a hacker broke into a legacy computer system and stole old client logs following weeks of public denials of such activity. (Bloomberg)

⚠️ A China-linked espionage group has been targeting a vulnerability in Ivanti's VPN products since mid-March. (CyberScoop)

🚢 The Port of Seattle says that ransomware hackers who broke into its systems last year accessed data belonging to roughly 90,000 people. (The Record)

💥 Someone hijacked and defaced a ransomware gang's dark-web site over the weekend. The site now reads, "Don't do crime CRIME IS BAD xoxo from Prague." (That'll show 'em.)