Trump administration takes aim at Biden and Obama cybersecurity rules

President Donald Trump signed an executive order Friday that revises and rolls back cybersecurity policies set in place by his Democratic predecessors, Barack Obama and Joe Biden.

In a White House fact sheet, the administration claims that Biden’s Executive Order 14144 — signed days before the end of his presidency — was an attempt “to sneak problematic and distracting issues into cybersecurity policy.”

Among other things, Biden’s order encouraged agencies to “consider accepting digital identity documents” when public benefit programs require ID. Trump struck that part of the order, with the White House now saying this approach risks “widespread abuse by enabling illegal immigrants to improperly access public benefits.”

However, Mark Montgomery, senior director of the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation, told Politico that “the fixation on revoking digital ID mandates is prioritizing questionable immigration benefits over proven cybersecurity benefits.” 

On AI, Trump removed Biden’s requirements around testing the use of AI to defend energy infrastructure, funding federal research programs around AI security, and directing the Pentagon to “use AI models for cyber security.”

The White House describes its moves on AI as refocusing AI cybersecurity strategy “towards identifying and managing vulnerabilities, rather than censorship.” (Trump’s Silicon Valley allies have complained repeatedly about the threat of AI “censorship.”)

Trump’s order also removed requirements that agencies start using quantum-resistant encryption “as soon as practicable.” And it removed requirements that federal contractors attest to the security of their software — the White House describes those requirements as “unproven and burdensome software accounting processes that prioritized compliance checklists over genuine security investments.”

Going back even further, Trump’s executive order repeals Obama’s policies around sanctions for cybersecurity attacks on the United States; those sanctions can now only be applied to “foreign malicious actors.” The White House says this will will prevent “misuse against domestic political opponents” and clarify that “sanctions do not apply to election-related activities.”