#### [Cyber-crime](/security/cyber_crime/)**3** Cybercrime is ‘orders of magnitude’ larger than state-backed ops, says ex-White House advisor=============================================================================================**3** Michael Daniel also thinks Uncle Sam should increase help to orgs hit by ransomware———————————————————————————–[Jessica Lyons](/Author/Jessica-Lyons ‘Read more by this author’) Sat 24 May 2025 // 17:47 UTC [](https://www.reddit.com/submit?url=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=Cybercrime%20is%20%27orders%20of%20magnitude%27%20larger%20than%20state-backed%20ops%2c%20says%20ex-White%20House%20advisor) [](https://twitter.com/intent/tweet?text=Cybercrime%20is%20%27orders%20of%20magnitude%27%20larger%20than%20state-backed%20ops%2c%20says%20ex-White%20House%20advisor&url=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=Cybercrime%20is%20%27orders%20of%20magnitude%27%20larger%20than%20state-backed%20ops%2c%20says%20ex-White%20House%20advisor&summary=Michael%20Daniel%20also%20thinks%20Uncle%20Sam%20should%20increase%20help%20to%20orgs%20hit%20by%20ransomware) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) INTERVIEW Uncle Sam’s cybersecurity apparatus can’t only focus on China and other nation-state actors, but also has to fight the much bigger damage from plain old cybercrime, says former White House advisor Michael Daniel. And the Trump administration’s steep cuts to federal government staff are making that a lot harder.Daniel currently leads the Cyber Threat Alliance, a nonprofit threat-intel-sharing organization. Before he took that role, he served as special assistant to President Obama and cybersecurity coordinator on the National Security Council staff between 2012 and 2017.He agrees that China [poses the single greatest threat](https://www.theregister.com/2025/04/29/china_us_cyber_threat/) we face in cyberspace, surpassing the Russians. But they’re far from the only threat. ’And certainly, a country like the United States with the scope and scale of our national interest, our economic interests, our public health and safety – we’ve got to be able to do the equivalent of walk and chew gum at the same time,’ he continued.  ’We’ve got to be able to focus on and have capacity for more than one adversary. We cannot take our eyes off, or should not take our eyes off, Russia, Iran, North Korea, or the large number of cyber criminal organizations that are out there,’ Daniel told *The Register*.’For a manufacturing or retail company somewhere in the United States, by far, your greatest threat is cybercrime, probably in the form of ransomware, but also in the form of business email compromise,’ Daniel said. This varies by sector – tech firms, for example, also face the risk of IP theft from China. But for most US organizations, ‘cybercrime activities are orders of magnitude larger than anything that the nation states are doing,’ he noted.Fighting all these threats is going to be harder as the Trump administration slashes government spending. ‘[The reductions across the board](https://www.theregister.com/2025/05/13/trump_government_layoffs_frozen/) in the federal government are going to negatively affect cybersecurity, both for the federal government itself and for the nation as a whole,’ Daniel said.’In particular, the reductions at the Cybersecurity and Infrastructure Security Agency, CISA, will have some negative impacts, but it’s also occurring at the sector-risk management agencies that were already stretched pretty thin in terms of their cyber capabilities to begin with,’ he added.Each of America’s 16 critical infrastructure sectors has its own risk management agency tasked with coordinating between the critical infrastructure owners/operators, Homeland Security, and other relevant federal agencies on managing risk – and incidents, cyber or otherwise, should they occur.They fall under CISA’s umbrella, and are being [gutted](https://www.theregister.com/2025/04/08/cisa_cuts_threat_intel/) by the Trump administration’s ongoing cost-cutting efforts. We don’t know how many CISA employees have been axed or are facing the chopping block because [Homeland Security won’t say](https://www.theregister.com/2025/05/19/cisa_deputy_director_gottumukkala/).> We cannot take our eyes off, or should not take our eyes off, Russia, Iran, North Korea, or the large number of cyber criminal organizations that are out thereBut we do know that Trump’s proposed spending plan would [slash CISA’s budget](https://www.theregister.com/2025/05/06/cisa_budget_cuts/) by $491 million, or about 17 percent.’I don’t think it’s the right move. I don’t think it’s the right policy decision to reduce our cybersecurity workforce,’ Daniel said. ‘The federal government has always had trouble and will always have trouble recruiting in cybersecurity because of the difference in pay scales, and the demand is only growing.’If anything, the feds should be boosting infosec budgets and employees, and doing more to help businesses protect themselves from the ever-increasing digital threats, he added.Daniel says he doesn’t have ‘hard numbers’ on how many federal employees have been fired or taken the government’s buy-out offer, either. ‘And that is something that, frankly, the executive branch owes the legislative branch as part of the legislative branch’s oversight function,’ he opined.’Just as a practical matter for management: you should know how many people you know you’ve let go,’ Daniel added. ‘Somebody has to know that number. And I don’t see any reason why you shouldn’t be transparent about that.’Anecdotally, upwards of 20 people have personally reached out to Daniel for career transition advice, he said.* [As CISA braces for more cuts, threat intel sharing takes a hit](https://www.theregister.com/2025/04/08/cisa_cuts_threat_intel/)* [CISA has a new No. 2 … but still no official top dog](https://www.theregister.com/2025/05/19/cisa_deputy_director_gottumukkala/)* [US officials close to persuading allies to not pay off ransomware crooks](https://www.theregister.com/2023/10/31/us_ransomware_payment_ban/)* [Ransomware scum and other crims bilked victims out of a ‘staggering’ $16.6B last year, says FBI](https://www.theregister.com/2025/04/24/ransomware_scum_and_other_crims/)On the cyber-crime front, he said he worries that the Justice Department and Homeland Security’s [realignment](https://www.theregister.com/2025/04/30/noem_put_cisa_on_mission/) and shifting focus to [border security](https://www.theregister.com/2024/11/23/trump_noem_homeland_security/), as opposed to network security, will mean less assistance to companies trying to [recover from ransomware attacks](https://www.theregister.com/2025/05/14/ransomware_targets_middle_systems_sans/) and other [financially motivated breaches](https://www.theregister.com/2025/04/24/ransomware_scum_and_other_crims/).There are a number of things the federal government should be doing to help these companies protect their networks and their data, Daniel added. ‘One of them that it really does need to focus on is how to disrupt that cyber-criminal ecosystem,’ through efforts including the Biden-era [international counter ransomware initiative](https://www.theregister.com/2023/10/31/us_ransomware_payment_ban/) and other related programs to cut off money to the crooks.’Those are important efforts to keep going, to increase the pressure on cybercriminals, and to increase the pressure on the countries that harbor them,’ Daniel said, naming Russia as ‘one of the prime countries’ that does this, ‘far more than China, in terms of the number of cyber criminals that it harbors.’Also on his wish list: increased assistance to state and local governments, along with education and [healthcare](https://www.theregister.com/2025/04/02/disaster_recovery_healthcare/) hit by ransomware infections.’If you’re a rural hospital chain, it’s not likely that you can afford a Mandiant or a CrowdStrike,’ Daniel said. ‘You’ve got to turn somewhere to help you recover from an incident, and to build your system better so that you are less likely to have an incident in the future. It’s in the federal government’s interest – and in our society’s interest – to have the federal government have the capacity to help certain aspects of our critical infrastructure fight back against these kinds of activities.’ ® [Sponsored: Learn more about AWS Global Partner Security Initiative](https://go.theregister.com/tl/3161/shttps://go.theregister.com/k/AWS_Vendor_Voice) Share [](https://www.reddit.com/submit?url=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=Cybercrime%20is%20%27orders%20of%20magnitude%27%20larger%20than%20state-backed%20ops%2c%20says%20ex-White%20House%20advisor) [](https://twitter.com/intent/tweet?text=Cybercrime%20is%20%27orders%20of%20magnitude%27%20larger%20than%20state-backed%20ops%2c%20says%20ex-White%20House%20advisor&url=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=Cybercrime%20is%20%27orders%20of%20magnitude%27%20larger%20than%20state-backed%20ops%2c%20says%20ex-White%20House%20advisor&summary=Michael%20Daniel%20also%20thinks%20Uncle%20Sam%20should%20increase%20help%20to%20orgs%20hit%20by%20ransomware) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) #### More about* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Federal government of the United States](/Tag/Federal%20government%20of%20the%20United%20States/)* [Security](/Tag/Security/) More like these × ### More about* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Federal government of the United States](/Tag/Federal%20government%20of%20the%20United%20States/)* [Security](/Tag/Security/)* [Threatscape](/Tag/Threatscape/) ### Narrower topics* [2FA](/Tag/2FA/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [CISO](/Tag/CISO/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Cybercrime](/Tag/Cybercrime/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [Encryption](/Tag/Encryption/)* [Exploit](/Tag/Exploit/)* [Federal Aviation Administration](/Tag/Federal%20Aviation%20Administration/)* [Firewall](/Tag/Firewall/)* [GPS](/Tag/GPS/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [Identity Theft](/Tag/Identity%20Theft/)* [Immigration and Nationality Act of 1965](/Tag/Immigration%20and%20Nationality%20Act%20of%201965/)* [Incident response](/Tag/Incident%20response/)* [Infosec](/Tag/Infosec/)* [Infrastructure Security](/Tag/Infrastructure%20Security/)* [IRS](/Tag/IRS/)* [Kenna Security](/Tag/Kenna%20Security/)* [NASA](/Tag/NASA/)* [National Highway Traffic Safety Administration](/Tag/National%20Highway%20Traffic%20Safety%20Administration/)* [National Institute of Standards and Technology](/Tag/National%20Institute%20of%20Standards%20and%20Technology/)* [National Labor Relations Board](/Tag/National%20Labor%20Relations%20Board/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Personally Identifiable Information](/Tag/Personally%20Identifiable%20Information/)* [Phishing](/Tag/Phishing/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Ransomware](/Tag/Ransomware/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Surveillance](/Tag/Surveillance/)* [Telecommunications Act of 1996](/Tag/Telecommunications%20Act%20of%201996/)* [TLS](/Tag/TLS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [United States Department of Defense](/Tag/United%20States%20Department%20of%20Defense/)* [United States Department of Justice](/Tag/United%20States%20Department%20of%20Justice/)* [US Securities and Exchange Commission](/Tag/US%20Securities%20and%20Exchange%20Commission/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [Zero trust](/Tag/Zero%20trust/) ### Broader topics* [Government](/Tag/Government/)* [United States of America](/Tag/United%20States%20of%20America/) #### More aboutShare [](https://www.reddit.com/submit?url=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=Cybercrime%20is%20%27orders%20of%20magnitude%27%20larger%20than%20state-backed%20ops%2c%20says%20ex-White%20House%20advisor) [](https://twitter.com/intent/tweet?text=Cybercrime%20is%20%27orders%20of%20magnitude%27%20larger%20than%20state-backed%20ops%2c%20says%20ex-White%20House%20advisor&url=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=Cybercrime%20is%20%27orders%20of%20magnitude%27%20larger%20than%20state-backed%20ops%2c%20says%20ex-White%20House%20advisor&summary=Michael%20Daniel%20also%20thinks%20Uncle%20Sam%20should%20increase%20help%20to%20orgs%20hit%20by%20ransomware) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2025/05/24/cyber_crime_bigger_than_nation_state/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) **3** COMMENTS #### More about* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Federal government of the United States](/Tag/Federal%20government%20of%20the%20United%20States/)* [Security](/Tag/Security/) More like these × ### More about* [Cybersecurity and Infrastructure Security Agency](/Tag/Cybersecurity%20and%20Infrastructure%20Security%20Agency/)* [Federal government of the United States](/Tag/Federal%20government%20of%20the%20United%20States/)* [Security](/Tag/Security/)* [Threatscape](/Tag/Threatscape/) ### Narrower topics* [2FA](/Tag/2FA/)* [Advanced persistent threat](/Tag/Advanced%20persistent%20threat/)* [Application Delivery Controller](/Tag/Application%20Delivery%20Controller/)* [Authentication](/Tag/Authentication/)* [BEC](/Tag/BEC/)* [Black Hat](/Tag/Black%20Hat/)* [BSides](/Tag/BSides/)* [Bug Bounty](/Tag/Bug%20Bounty/)* [CHERI](/Tag/CHERI/)* [CISO](/Tag/CISO/)* [Common Vulnerability Scoring System](/Tag/Common%20Vulnerability%20Scoring%20System/)* [Cybercrime](/Tag/Cybercrime/)* [Cybersecurity](/Tag/Cybersecurity/)* [Cybersecurity Information Sharing Act](/Tag/Cybersecurity%20Information%20Sharing%20Act/)* [Data Breach](/Tag/Data%20Breach/)* [Data Protection](/Tag/Data%20Protection/)* [Data Theft](/Tag/Data%20Theft/)* [DDoS](/Tag/DDoS/)* [DEF CON](/Tag/DEF%20CON/)* [Digital certificate](/Tag/Digital%20certificate/)* [Encryption](/Tag/Encryption/)* [Exploit](/Tag/Exploit/)* [Federal Aviation Administration](/Tag/Federal%20Aviation%20Administration/)* [Firewall](/Tag/Firewall/)* [GPS](/Tag/GPS/)* [Hacker](/Tag/Hacker/)* [Hacking](/Tag/Hacking/)* [Hacktivism](/Tag/Hacktivism/)* [Identity Theft](/Tag/Identity%20Theft/)* [Immigration and Nationality Act of 1965](/Tag/Immigration%20and%20Nationality%20Act%20of%201965/)* [Incident response](/Tag/Incident%20response/)* [Infosec](/Tag/Infosec/)* [Infrastructure Security](/Tag/Infrastructure%20Security/)* [IRS](/Tag/IRS/)* [Kenna Security](/Tag/Kenna%20Security/)* [NASA](/Tag/NASA/)* [National Highway Traffic Safety Administration](/Tag/National%20Highway%20Traffic%20Safety%20Administration/)* [National Institute of Standards and Technology](/Tag/National%20Institute%20of%20Standards%20and%20Technology/)* [National Labor Relations Board](/Tag/National%20Labor%20Relations%20Board/)* [NCSAM](/Tag/NCSAM/)* [NCSC](/Tag/NCSC/)* [Palo Alto Networks](/Tag/Palo%20Alto%20Networks/)* [Password](/Tag/Password/)* [Personally Identifiable Information](/Tag/Personally%20Identifiable%20Information/)* [Phishing](/Tag/Phishing/)* [Quantum key distribution](/Tag/Quantum%20key%20distribution/)* [Ransomware](/Tag/Ransomware/)* [Remote Access Trojan](/Tag/Remote%20Access%20Trojan/)* [REvil](/Tag/REvil/)* [RSA Conference](/Tag/RSA%20Conference/)* [Spamming](/Tag/Spamming/)* [Spyware](/Tag/Spyware/)* [Surveillance](/Tag/Surveillance/)* [Telecommunications Act of 1996](/Tag/Telecommunications%20Act%20of%201996/)* [TLS](/Tag/TLS/)* [Trojan](/Tag/Trojan/)* [Trusted Platform Module](/Tag/Trusted%20Platform%20Module/)* [United States Department of Defense](/Tag/United%20States%20Department%20of%20Defense/)* [United States Department of Justice](/Tag/United%20States%20Department%20of%20Justice/)* [US Securities and Exchange Commission](/Tag/US%20Securities%20and%20Exchange%20Commission/)* [Vulnerability](/Tag/Vulnerability/)* [Wannacry](/Tag/Wannacry/)* [Zero trust](/Tag/Zero%20trust/) ### Broader topics* [Government](/Tag/Government/)* [United States of America](/Tag/United%20States%20of%20America/) #### TIP US OFF[Send us news](https://www.theregister.com/Profile/contact/)[#### CISA has a new No. 2 … but still no official top dogBrain drain, budget cuts, constant cyberthreats – who wouldn’t want this job?Security5 days -| 5](/2025/05/19/cisa_deputy_director_gottumukkala/?td=keepreading) [#### Snowflake CISO on the power of ‘shared destiny’ and ‘yes and’interview Lessons learned from last year’s security snafuCSO9 days -| 3](/2025/05/15/snowflake_ciso_interview/?td=keepreading) [#### Russia’s Fancy Bear swipes a paw at logistics, transport orgs’ email serversTheir connection? Aiding Ukraine, duhSecurity3 days -| 9](/2025/05/21/russias_fancy_bear_alert/?td=keepreading) [#### Why rapid proliferation of cloud native apps requires faster, more efficient toolsetsKubernetes enables easy, rapid AI app development, making it the industry standard for AI workloadsSponsored feature](/2025/05/13/nutanix_cloud_native_ai_apps/?td=keepreading) [#### CISA slammed for role in ‘censorship industrial complex’ as budget faces possible $500M cutBecause who needs cybersecurity when there’s culture wars to winPublic Sector19 days -| 38](/2025/05/06/cisa_budget_cuts/?td=keepreading) [#### CISA mutes own website, shifts routine cyber alerts to Musk’s X, RSS, emailUpdated Cripes, we were only joking when we called Elon’s social network the new state mediaSecurity12 days -| 67](/2025/05/12/cisa_vulnerabilities_updates_x/?td=keepreading) [#### Fired US govt workers, Uncle Xi wants you! — to apply for this fake consulting gigPhony LinkedIn recruitment ads? GroundbreakingPublic Sector8 days -| 27](/2025/05/16/attn_fired_us_govt_workers/?td=keepreading) [#### ‘Ongoing’ Ivanti hijack bug exploitation reaches cloudsNothing like insecure code in security suitesCSO4 days -| 4](/2025/05/21/ivanti_rce_attacks_ongoing/?td=keepreading) [#### Socket buys Coana to tell you which security alerts you can ignoreSometimes, less information is moreSecurity9 days -|](/2025/05/15/socket_get_jacked_with_reachability/?td=keepreading) [#### Ivanti makes dedicated fans of Chinese spies who just can’t resist attacking its buggy kitIf it ain’t broke?CSO2 days -| 1](/2025/05/23/ivanti_chinese_spies_attack/?td=keepreading) [#### Dems are upset about DOGE’s IRS hackathon, but the IRS says it never happenedTax bods characterize it more as a brainstorming session, says Elon’s unit wasn’t involvedPublic Sector8 days -| 19](/2025/05/16/congress_question_doge_it_overhaul/?td=keepreading) [#### ‘We still have embeds in CISA’: CTO of Brit cyber agency talks post-Trump relationship with US counterpartCYBERUK Both agencies seem unbothered despite tech world’s clear concerns for US infoseccersSecurity11 days -| 6](/2025/05/13/cisa_ncsc/?td=keepreading)
Related Tags:
FROZENLAKE
Forest Blizzard
NAICS: 54 – Professional
Scientific
Technical Services
NAICS: 519 – Web Search Portals
Libraries
Archives
Other Information Services
NAICS: 541 – Professional
Scientific
Technical Services
NAICS: 518 – Computing Infrastructure Providers
Data Processing
Web Hosting
Related Services
NAICS: 92 – Public Administration
NAICS: 922 – Justice
Public Order
Safety Activities
NAICS: 51 – Information
Associated Indicators: