Hello. WSJ Pro's David Uberti looks at how momentum behind cyber legislation and federal mandates is pushing the Cybersecurity and Infrastructure Security Agency to become an enforcer. It's a role that CISA Director Jen Easterly says she doesn't want, while at the same time advocating for more leverage to get businesses to reveal details about cyberattacks they suffer.

The balancing act previews longer-term questions for the agency as the Biden administration and some lawmakers press to expand cyber requirements across the U.S. economy.

This and other news below.

Building trust: The U.S. cyber agency wants to avoid the R-word.

“We’re not a regulator,” Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, said last week at a conference hosted by security company Mandiant Inc. “We don’t want to be a regulator.”

Legislation in Congress could push CISA into such a role by giving the agency power to write rules forcing companies to report hacks, subpoena them for information and potentially fine noncompliant firms, businesses say.

And that, some companies say, could impair any trust that has been built between public and private organizations. 

Read the full story. 

Creamy or crunchy? A Navy engineer with national security clearance and his wife were arrested after allegedly trying to sell nuclear secrets to an undercover FBI agent. Information was encrypted—including a memory card wrapped in plastic and hidden in half of a peanut butter sandwich—and communications during 2020 and 2021 were made using encrypted email, according to the Justice Department. The engineer asked to be paid in the Monero, saying that bitcoin and other cryptocurrencies were risky, a federal complaint says. (Bleeping Computer)

Comparitech, a tech research group, made an interactive U.S. map showing ransomware attacks by year, size, industry and strain. Where possible, it includes whether the victim paid a ransom. Check it out here.

• Booz Allen is looking to strike more tuck-in deals than in previous years to accelerate its growth rate, Chief Financial Officer Lloyd Howell said. Tuck-ins involve a company buying a smaller business and integrating it into its operations.
• The firm plans to spend about $4 billion between April 2022 and March 2025, largely on acquisitions, executives said at last week's investor day. That is up from the $1.3 billion it spent in total during the past four fiscal years, the most recent ending in March.

Write to the WSJ Pro Cybersecurity Team: Kim S. Nash, James Rundle, Catherine Stupp and David Uberti.

Follow us on Twitter: @knash99, @catstupp and @DavidUberti. 

Contact Enterprise Technology Editor Steve Rosenbush at steven.rosenbush@wsj.com or follow him on Twitter: @Steve_Rosenbush.