CISA fires, now rehires and immediately benches security crew on full pay

The upheaval at the US government’s Cybersecurity and Infrastructure Security Agency, aka CISA, took another twist on Tuesday, as it moved to reinstate staffers it had fired over the past few weeks – specifically those still in their probationary period – though they’ve been benched on paid leave for now.

Last week, a senior penetration tester at CISA claimed his 100-plus-strong red team as well as its support workers were dismissed after Elon Musk’s Trump-blessed cost-trimming DOGE unit pulled the plug on a federal government contract; a second CISA red team was also said to have been cut soon after.

The cyber-agency quickly confirmed it had indeed dumped a number of workers, and said its remaining red teams will continue to operate as usual.

Then a federal judge ordered [PDF] the reinstatement of axed probationary US government workers by March 17, after determining that their terminations by DOGE across the board was unlawful. The decision affects about 25,000 federal workers.

CISA is thus following the letter of that judgment, in that the ejected probationary staffers have been reinstated, though they’ve been promptly parked on paid administrative leave. Weirdly enough, this decision was broadcast on the agency’s website, presumably in case it’s unable to get hold of laid-off folks and hopes they’ll see that page.

“Administrative leave is a management authorized leave category and does not count against your annual or sick leave balance,” CISA bosses explained in an earlier note to probationary staff. “Upon reinstatement, your pay and benefits will restart, and all requirements of federal employment will be applicable including your ethical obligations. Nothing in this process implicates your ability to voluntarily resign.”

The judge’s temporary restraining order, stemming from a lawsuit filed by the state of Maryland and others against the US administration challenging the legality of the layoffs, mandated that certain terminated federal employees be reinstated by Monday. Specifically, the order applies to individuals dismissed from agencies including CISA since January 20, 2025, who were still in probationary status at the time of termination.

A spokesperson for CISA told The Register it couldn’t comment on a case where there was ongoing legal proceedings. That suggests to us the Maryland matter, separate from the similar California case we covered last week, isn’t over in the eyes of Uncle Sam and so probationary bods are being parked on leave while this battle plays out.

One person familiar with the situation at the agency told us today 130 staffers have been given their jobs back, though they are indeed on paid leave for now.

The result is hardly a model of efficiency. CISA is now paying staff who aren’t allowed to work, pending the outcome of ongoing legal wrangling. Meanwhile, it’s unclear how many will actually return once the dust settles. Federal agencies have long struggled to compete with private sector salaries for skilled security professionals, many of whom stay for the mission rather than the money.

For now, at least some of America’s public-sector cyber defenders remain sidelined, waiting to see how the case plays out. ®

READ MORE HERE