Donald Trump hadn’t even been inaugurated yet and Joshua Steinman was already having his ambitions thwarted.
Steinman believed in Trump. A former Navy lieutenant in his early 30s, he had volunteered for the campaign and was eager to join the White House team. Steinman had a specific job in mind: chief of cybersecurity. And he knew exactly how he would get there.
The former Defense Intelligence Agency official got in touch with his old director, incoming national security adviser Michael Flynn, and quickly joined the National Security Council staff last January in a critical role.
ADVERTISEMENT
But two days before the inauguration, Steinman got a lesson in internecine bureaucratic warfare. While he and the rest of the incoming cybersecurity staff received a briefing by Barack Obama’s outgoing aides, Tom Bossert, the incoming White House homeland security adviser, barged in and upended Steinman’s plans. Bossert said that he and Flynn had agreed that cybersecurity would be Bossert’s turf, adjacent to but outside the NSC, similar to the way it worked under Bossert’s predecessor in the Obama administration. The top cybersecurity coordinator for the U.S. government would be Rob Joyce—not Joshua Steinman.
A year and a half later, Flynn, Bossert and Joyce are all gone from the West Wing and the Old Executive Office Building, in various degrees of ignominy and humiliation. Joyce returned to the National Security Agency earlier this month, where he previously served for more than two decades—but not before Steinman tried, at every turn, to undermine him and go around him for official duties, according to current and former officials who worked with him. Flynn was fired just a few weeks into the Trump presidency without having the opportunity to promote Steinman.
There’s a new national security adviser, John Bolton, who has made sweeping changes to the White House cybersecurity apparatus. Earlier this month, shortly after Joyce’s departure from the NSC, Bolton got rid of the cybersecurity coordinator role entirely. Late last week, a Coast Guard rear admiral stepped into Bossert’s old position as Trump’s White House homeland security adviser, setting up a new and unclear internal power dynamic. Steinman, however, remains one of Bolton’s two lead cybersecurity staffers.
Amid the recent upheaval, NSC officials responsible for coordinating cybersecurity strategy are engaging in what one U.S. official with direct knowledge of the matter described as a near-legendary level of ego-fueled sniping. Steinman is said to remain focused on offensive measures—though a senior administration official disputed that—even as the United States’ cybersecurity defense remains a major problem. Current and former officials say he has depleted his supply of good will from the agencies that execute the cybersecurity strategy the White House is supposed to set.
“Our nation is getting hacked left and right, and the senior director responsible for the cybersecurity strategy doesn't have any cyber experience and is spending his time playing junior Game of Thrones inside the NSC, instead of getting out the strategy,” another administration official said. “He can’t get it done.”
Steinman now helms a cybersecurity apparatus that, according to a government review released last Wednesday, has been thus far unable to completely secure federal computer networks. The report, conducted by the White House and the Department of Homeland Security, showed that 71 out of 96 federal agencies examined were using cybersecurity programs “at risk or high risk.” As Politico’s Eric Geller reported on Monday, there are substantial fears among cybersecurity veterans and experts that the new bureaucratic arrangement—which oversees a sprawling government that does not always seem to prioritize or even understand digital security—is a blinking red light.
Garrett Marquis, a spokesman for the National Security Council, defended what he called a “streamlined” cybersecurity structure.
“Cybersecurity is one of Ambassador Bolton’s highest priorities and he, along with his leadership team, are personally engaged on key cyber matters. The streamlined structure reduces bureaucracy, promotes cybersecurity, and enables planning for tomorrow’s cyber-workforce,” Marquis told The Daily Beast.
Yet Sen. Mark Warner (D-Va.), the vice chairman of the Senate intelligence committee, warned that the change represented a digital vulnerability.
“At a time when we should be ramping up our defenses against hackers and making cybersecurity a top priority across the entire federal government, it seems that the NSC is instead mired in a half-baked bureaucratic reorganization that will leave us less able to respond to increasingly asymmetric cyber threats,” Warner, an outspoken critic of the administration’s decision to scrap the cyber coordinator role, told The Daily Beast.
According to the current official and one former Trump White House cybersecurity official, Steinman, a political appointee who hails from the #MAGA wing of the administration, had been a quiet hand in getting Bolton to push Bossert and Joyce out. The officials disagree about how much credit or blame Steinman deserves: one of them called it a “quiet coup”—echoing previous reporting by CyberScoop—while the other thought it was more a matter of pitching Bolton on an elevated role that would have the added benefit of ending a rival power center in the White House.
But they agree that Steinman’s rise during a period of power struggles is concerning, as the federal government struggles to cobble together a comprehensive cybersecurity strategy.
“He’s very inexperienced,” a former Trump NSC cybersecurity aide told The Daily Beast, adding that Steinman has angered the real centers of operational cybersecurity power in the government with a style that implies that these more senior officials work for the NSC. He portrays himself as a political insider, making it difficult for him to come off as objective and, in turn, earn the trust of career intelligence officials.
“He fancied himself an operator,” the former official added.
Those career officials are hesitant to work with Steinman, and “people chuckle and groan when he’s invoked,” the current official said. As a result, the intelligence community is barely working with him on what the official described as what should be the government’s top priority: the integrity of the 2018 vote. Even the White House’s own cybersecurity review has found an alarmingly porous cyber infrastructure at the federal level just six months before the midterm elections.
The ex-official isn’t completely down on Steinman, however. After some time on the job, Steinman developed an ability to recognize when he was out of his depth, and adapt accordingly. And even if Steinman’s experience isn’t deep, his impulse to “make cyber a more practical tool in the arsenal” is “legitimate at the 40-thousand-foot level,” the former official said.
But a fundamental problem, the ex-official continued, is that Steinman tends to act as if his NSC position permits him to command the government’s hacker armies and network defenders.
Steinman refers to himself as “Special Assistant to the President for Cyber” in his Twitter bio, a position that implies a direct relationship with Trump; the senior administration official said Steinman got the title upon his entrance in the administration, along with his senior-director title. The military’s Cyber Command, its conjoined twin the NSA, and the Department of Homeland Security, don’t appreciate his taskings. It doesn’t help that many of Steinman’s counterparts are colonels, Navy captains and flag or general officers, who are quick to note—fairly and not—that they outrank the former Navy lieutenant.
“His tactics get the interagency to generate antibodies to him,” the ex-official said. That’s not an auspicious beginning for someone with such an outsized responsibility on an urgent security issue—and particularly so now that his rival Joyce is back at Fort Meade.
The senior administration official disputed that Steinman had any tension with the agencies. “The NSC Cyber directorate and its leadership team enjoys strong working relationships across the interagency to include with the intelligence community,” the official said.
According to his former colleagues but disputed by the senior administration official, Steinman focuses on offensive cyber—bricking computers used by adversaries, exfiltrating or corrupting data and messing with foreign networks. Yet these tasks aren’t for the NSC, they’re for CYBERCOM and NSA, and one former official said Steinman doesn’t always grasp the complexities or second-order effects of launching digital attacks—namely, the potential for an adversary’s virtual weapon released onto the internet to spread like wildfire.
But despite Steinman being formally a senior NSC director for cybersecurity, sources said the defensive end of the digital-security space is going to fall to someone else—though, again, the senior official disputed that. Grant Schneider, a holdover from the Obama administration, handles defense responsibilities, and he also holds a senior-director title on the NSC. Like Steinman, Schneider is a Defense Intelligence Agency veteran, having served as the intelligence agency’s chief information officer. Unlike Steinman, Schneider is not a “Flynnstone”—a protege and acolyte of Mike Flynn. Schneider was also the deputy chief information-security officer for the federal government beginning at the end of Obama’s tenure.
More recently, Steinman has been bragging to co-workers about his relationship with Bolton, and has hinted that he helped install Mira Ricardel as Bolton’s deputy. Some speculate that it’s an intimidation tactic. NSC officials are scared to say anything about Steinman’s management style because of how he touts his closeness to both Bolton and Ricardel, who helm the NSC.
The senior administration official strongly denied that Steinman played any role in bringing Ricardel aboard. “Mr. Steinman found out about Ms. Ricardel’s hiring at the same time as everyone else and did not participate in her selection, nor has he claimed to have done so. Ambassador Bolton has known Ms. Ricardel for nearly two decades, and did not consult with Mr. Steinman, or any other NSC staff officer, on his selection of Ms. Ricardel as his deputy,” the official said.
Whether Steinman has finally achieved his ambition is unclear.
On Friday, the White House announced that a Coast Guard rear admiral, Douglas Fears, would become Bossert’s effective replacement as Trump’s homeland security adviser. Fears, who has been serving in the NSC’s office for resilience against natural disasters, will be “overseeing the NSC Cybersecurity Directorate,” Bolton said in a statement, among other tasks.
(Asked to clarify the professional relationship between Steinman and Fears, the senior administration official pointed back to Bolton’s statement.)
While Fears may be the new Bossert, there is no new Joyce to wrangle a sprawling multi-agency cybersecurity apparatus. Fears’ experience with digital network defense is said to be minimal. In other words, the rise of Fears may not have impeded Steinman, and instead afforded Steinman another opportunity to assert control over cybersecurity from the White House.
Editor’s Note: Grant Schneider served as the deputy chief information-security officer for the federal government beginning at the end of Obama's tenure. A previous version of this story stated that he was the chief information-security officer.
