Cybersecurity Policy Report, Compromise Defense Bill Calls for Study of Stand-Alone Cyber Force, (Dec 9, 2024)

By Tom Leithauser

The Department of Defense would have to arrange a study on whether to establish a sixth uniformed service—U.S. Cyber Force—under a compromise version of the fiscal year 2025 National Defense Authorization Act (NDAA) released over the weekend.

The bill would require DoD to contract with the National Academy of Sciences, Engineering, and Medicine to study “the advisability of either establishing a separate Armed Force in the Department of Defense dedicated to operations in the cyber domain or refining and further evolving the current organizational approach for United States Cyber Command,” according to a conference report released along with the NDAA’s text.

Both the House and Senate versions of the NDAA contained similar language regarding the Cyber Force study, which reflected concerns about Cyber Command’s ability to fulfill its mission as a combatant command rather than a stand-alone service (CPR, July 9).

“We note that finding the optimal structure for cyber operations continues to be a work in progress,” the conference report says. “We also recognize that such evolution is even more difficult when those forces are fully engaged in a demanding training environment, competition with the private sector for a limited workforce pool, and complicated by a constant, demanding and high intensity operational tempo.”

“We believe that an independent, outside examination of these challenges may provide valuable insights to inform decision-makers on future force design concepts,” it adds.

The conference report and the NDAA text were the product of a House-Senate conference committee that sought to reconcile the provisions of the House-passed NDAA (H.R. 8070, 118th Cong. (2024)) and the NDAA approved by the Senate Armed Services Committee (S.B. 4638, 118th Cong. (2024)).

The negotiated version is being called the Servicemember Quality of Life Improvement and National Defense Authorization Act for Fiscal Year 2025 (H.R. 5009, 118th Cong. (2024)).

The report and negotiated bill text were released Saturday by the House and Senate committees on Armed Services. In an unusual move, the Senate this year didn’t vote on the NDAA. The conference committee instead used the version approved by the Senate Armed Services Committee in its negotiations.

Congressional leaders view the NDAA as “must-pass” legislation; every Congress since 1961 has managed to produce an annual defense bill, and lawmakers view the NDAA as a vehicle for other top legislative priorities.

The conference committee this year rejected several cyber provisions that lawmakers had sought to include. For example, it excluded language to enact the Federal Information Security Modernization Act (S.B. 2251, 118th Cong. (2023)) as requested by the bill’s sponsor, Sen. Gary Peters (D., Mich.), chairman of the Senate Homeland Security and Governmental Affairs Committee (CPR, July 12).

But it retained a watered-down version of a provision from the Senate’s FY 2025 Intelligence Authorization Act (S.B. 4443, 118th Cong (2024)) that would treat nations that harbor ransomware operators the same as “state sponsors of terror” (CPR, Aug. 1).

The ransomware provision removes the language about “state sponsors of terror” and a directive to the State Department and White House to impose economic sanctions on nations that harbor ransomware operators.

Instead the NDAA’s text offers a “sense of Congress” statement “that foreign ransomware organizations, and foreign affiliates associated with them, constitute hostile foreign cyber actors, that covered nations abet and benefit from the activities of these actors, and that such actors should be treated as hostile foreign cyber actors by the United States.”

The NDAA and conference report will now advance to consideration in the House and Senate. The House rules committee intends to meet this afternoon to consider procedures for bringing the legislation to the House floor.

News: DataSecurity FederalLegislation