Committee warned China is prepositioning in U.S. networks; witnesses urge restoring cyber workforce and stronger private‑sector defenses

Witnesses at the House Homeland Security hearing described sustained cyber operations by Chinese actors that they said go beyond theft to “preposition” capabilities inside U.S. infrastructure that could be used in crises.

Dr. Rush Doshi, identified to the committee as director of the China Strategies Initiative at the Council on Foreign Relations, said PRC cyber actors “compromised sensitive U.S. networks” with multiple objectives: collecting personal data, stealing intellectual property and “prepositioning for destructive cyber attacks on American power, gas, water, telecom, and transportation infrastructure.” William Evanina, former director of the National Counterintelligence and Security Center, similarly described the threat to critical infrastructure and said the nation must view the challenge with urgency.

Several members linked that concern to reported personnel changes at federal cyber and national security agencies. Ranking Member Bennie Thompson said that the administration’s removal of cybersecurity staff “makes it harder to protect Americans” and noted reported cuts at the Cybersecurity and Infrastructure Security Agency (CISA) and other offices. Witnesses warned that the PRC is investing heavily in cyber personnel for both offensive and defensive operations and that the United States needs to scale up both its technology and staffing. Dr. Doshi said, “We need to be scaling up, not scaling down.”

Panelists proposed specific steps to reduce U.S. vulnerability: codify and resource the information communications technology and services (ICTS) executive authority to block high‑risk PRC goods; pass measures to require secure procurement and deeper vetting of vendors that supply federal systems; fund and staff offensive cyber capabilities to counter adversary prepositioning; and increase federal‑private threat‑intelligence sharing so owners of privately held critical infrastructure receive timely signals about intrusions.

Witnesses and members also emphasized the private sector’s role. Craig Singleton, senior director of the China program at the Foundation for Defense of Democracies, and others said many breaches affect private companies first, and that regulators and Congress should incentivize or require minimum cyber hygiene and reporting so operators of critical infrastructure can act on intelligence they otherwise might not receive.

Members pressed for near‑term oversight steps, including staff letters asking agencies to detail how many personnel are assigned to China‑related threats and how recent personnel actions will affect operational capacity. Several witnesses recommended the committee ask CISA, OMB and other agencies for internal staffing and mission breakdowns related to China.