STUDY ON REDUCING INCENTIVES FOR CYBER ATTACKS ON DEFENSE CRITICAL INFRASTRUCTURE OF THE UNITED STATES.

SEC. 1543. STUDY ON REDUCING INCENTIVES FOR CYBER ATTACKS ON DEFENSE CRITICAL INFRASTRUCTURE OF THE UNITED STATES. (a) In General.—The Secretary of Defense, acting through the Under Secretary of Defense for Policy and the Chairman of the Joint Chiefs of Staff and in consultation with appropriate Federal entities, shall conduct a study on the use of military capabilities to increase the costs of, and consequently reduce the incentives of adversaries for, targeting defense critical infrastructure in cyberspace. (b) Study Requirements.—The study required by subsection (a) shall include the following: (1) An assessment of the cyber capabilities and intent of adversaries regarding attacks against defense critical infrastructure. (2) An identification of the cyber capabilities of adversaries upon which the use of military capabilities considered by such study would seek to impose costs. (3) A classification and prioritization of objectives that are relevant to the military to impose costs. (4) An assessment of the capabilities of and investments by the Department of Defense that would be required to create desired effects against the objectives described in paragraph (3). (5) An evaluation of the roles and relative effectiveness of military capabilities, including offensive cyber operations, both independent and integrated with other military capabilities and non-cyber measures, in credibly and in a scalable manner reducing the incentives of, by increasing the costs to, adversaries to target defense critical infrastructure in cyberspace. (6) An evaluation of methodologies specific to cyber for selectively revealing or concealing cyber and non-cyber military capabilities while preserving operational security. (7) The feasibility, advisability, and potential uses of the integrating capabilities of Federal agencies other than the Department of Defense, allies and partners of the United States, industry, and academia with the capabilities of the Department in efforts to increase the costs to adversaries to, and consequently reduce the incentives of adversaries, to target defense critical infrastructure in cyberspace. (8) An assessment of the policies and authorities in effect with respect to threatening the assets, forces, or capabilities of adversaries and enabling scalable and tailored response options to cyber attacks or preposturing for future attacks on defense critical infrastructure. (c) Briefing and Report.—Not later than December 1, 2026, the Secretary of Defense shall— (1) provide to the congressional defense committees a briefing on the findings of the study required by subsection (a); and (2) submit to the congressional defense committees a report on the findings of such study. (d) Definitions.—In this section: (1) The term “defense critical infrastructure” has the meaning given the term “critical infrastructure of the Department of Defense” in section 1650(e) of the National Defense Authorization Act for Fiscal Year 2017 (Public Law 114-328; 10 U.S.C. 2224 note). (2) The term “impose costs” means actions taken against an adversary of the United States that result in economic, diplomatic, informational, or military consequences that are sufficiently significant to change the behavior or assessment of such adversary regarding cyberspace operations against the United States.