Summary
- President Donald Trump signed memoranda in April 2025 targeting two former security officials.
- One targeted Miles Taylor, the former DHS official who wrote the 2018 “Anonymous” op-ed.
- The other targeted Chris Krebs, the former CISA director who vouched for the security of the 2020 election.
- The moves drew criticism from security leaders who warned about political retaliation.
Introduction
On April 9, 2025, President Donald Trump signed two presidential memoranda aimed at Miles Taylor and Chris Krebs, both former officials in his first administration’s homeland security apparatus. The memoranda directed the government to review their past government work and to suspend security clearances held by each man. To many in the security community, the orders looked like retaliation. They also raised a broader question: what happens when cybersecurity becomes personal politics?
Unmasking ‘Anonymous’: The Miles Taylor Saga
Mystery Solved: Who is ‘Anonymous’?
In September 2018, The New York Times published an anonymous op-ed by a “senior official in the Trump administration” describing a quiet resistance inside the government. A book followed in 2019. In October 2020, Miles Taylor, who had served as chief of staff to Homeland Security Secretary Kirstjen Nielsen, revealed that he was the author. Trump attacked him at the time, and the April 2025 memorandum called for an investigation of his conduct while in government.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Political Fallout
Critics saw the memo as part of a pattern of targeting people who had criticized the president. Some warned that it would distract from real cyber threats that need cooperation across party lines. Taylor has said he acted to warn the public about conduct he considered dangerous.
The Cybersecurity Chief Targeted: Chris Krebs
Defending the 2020 Election
After the 2020 presidential election, the Cybersecurity and Infrastructure Security Agency (CISA), then led by Chris Krebs, released a joint statement from election officials calling the vote “the most secure in American history.” The agency also ran a “Rumor Control” site rebutting false claims of fraud. Trump fired Krebs by tweet on November 17, 2020.
The Ongoing Aftermath
Krebs later co-founded a consulting firm and then joined SentinelOne as an executive. The April 2025 memorandum also ordered a review of security clearances held by people at SentinelOne. Krebs resigned from the company later that month, saying he would fight the order on his own.
The Political Dimensions of Cybersecurity
The Perils of Political Retaliation
Taking aim at named former officials this way is unusual. Observers warned that it could chill honest assessments from security officials and weaken trust in the agencies that defend elections and critical infrastructure.
Redirecting Focus to Threats
Security experts say attention belongs on actual threats, from Chinese state hackers in critical infrastructure to ransomware gangs. Turning security into a partisan fight makes cooperation harder, and attackers do not care which party is in power.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The Takeaway
The memoranda against Miles Taylor and Chris Krebs show how political grievances can spill into national security. Nonpartisan cooperation still matters for American cyber defense, and so does trust that officials can tell the public the truth about threats without fear of retaliation.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.