DHS Secretary Kristi Noem Fires 24 FEMA Employees Following Cybersecurity Breach

Department of Homeland Security Secretary Kristi Noem terminated two dozen Federal Emergency Management Agency employees on Friday after a cybersecurity review revealed that a “threat actor” had breached FEMA’s network systems due to significant security lapses.

The dismissed employees included FEMA Chief Information Officer Charles Armstrong and Chief Information Security Officer Gregory Edwards, along with 22 other IT personnel. The terminations came after a routine cybersecurity assessment uncovered critical vulnerabilities that allowed unauthorized access to FEMA’s network.

The Cybersecurity Breach

According to DHS statements, the investigation revealed “several severe lapses in security that allowed the threat actor to breach FEMA’s network and threaten the entire department and the nation as a whole”. The security failures included an agency-wide lack of multi-factor authentication, use of prohibited legacy protocols, failure to address known critical vulnerabilities, and inadequate operational visibility.

While the breach was identified before any sensitive data was compromised, DHS officials said the IT leadership at FEMA “resisted any efforts to fix the problem,” avoided scheduled inspections, and “lied to officials about the scope of the cyber vulnerabilities”. An internal FEMA email dated August 18 ordered all agency employees to change their passwords “due to recent cybersecurity incidents and threats”.

It remains unclear whether the threat came from a foreign actor, though DHS was among several agencies targeted by Chinese state-linked hackers using Microsoft software vulnerabilities last month.

Noem’s Response and Broader Context

“FEMA’s career IT leadership failed at every level. Their incompetence endangered the American public,” Noem stated in her announcement. She characterized the dismissed employees as “deep-state bureaucrats” who were “more concerned with covering up their failures than protecting the Homeland and the personal information of American citizens”.

This marks the second major personnel action Noem has taken at FEMA. In February, she dismissed four employees, including the agency’s chief financial officer, following allegations about improper fund allocation for migrant housing in New York City.

Political Tensions with Illinois Leadership

Meanwhile, tensions between Noem and Democratic leaders in Illinois continued to escalate. In a CBS “Face the Nation” interview that aired Sunday, Illinois Governor JB Pritzker responded to Noem’s recent criticisms and the Trump administration’s planned immigration enforcement operations in Chicago.

Pritzker said if Noem were to call him, he would tell her that “what she’s doing is inflaming passions and causing disruption that doesn’t need to be caused”. He accused the administration of targeting law-abiding residents who have lived in Illinois for decades, calling the enforcement tactics “anti-American” and “un-American”.

The governor also criticized the administration’s lack of coordination, noting that “no one in the administration, the President, or anybody under him, has called anyone in my administration” regarding planned immigration operations. He expressed concern about potential military involvement, stating that National Guard troops “don’t belong” on American city streets unless there is “an insurrection” or “truly an emergency”.

Background on Immigration Enforcement

These developments come amid the Trump administration’s expanded immigration enforcement efforts. Noem recently announced that approximately 1.6 million migrants without legal status have left the United States within the first 200 days of the administration, though immigration experts have questioned the reliability of these statistics.

The administration has also been preparing for major immigration enforcement operations in Chicago, similar to those conducted in Los Angeles, with operations potentially involving ICE, Customs and Border Protection, and other federal agencies. The planned Chicago operation is expected to last about 30 days and could begin as early as September 5.