HR 5009, Some Provisions - FY 2025 NDAA
Today the House is scheduled to take up HR 5009, which is the vehicle for the FY 2025 National Defense Authorization Act. The NDAA provides guidance and authorization for military programs, some of those provisions will have impacts outside of the military and defense industrial base. These provisions include cybersecurity, counter UAS operations, and commercial space operations.
Cybersecurity
Division A of the bill (Department of Defense Authorizations) includes a Subtitle B, Cybersecurity, in Title XV (Cyber Operations). That Subtitle includes five cybersecurity related sections:
§1511. Termination of reporting requirement for cross domain incidents and exemptions to policies for information technology.
§1512. Information technology programs of the National Background Investigation Service.
§1513. Guidance for application of zero trust strategy to Internet of Things hardware used in military operations.
§1514. Management and cybersecurity of multi-cloud environments.
§1515. Protective measures for mobile devices within the Department of Defense.
There is an additional cybersecurity provision in Division F (Intelligence Authorization Act, 2025):
§6508. Deeming ransomware threats to critical infrastructure as national intelligence priority.
While none of the Subtitle B sections have direct impact on non-DOD related entities, the guidance document outlined by §1513 and the strategy developed in response to §1514 may provide ways forward to address similar cybersecurity issues in the private sector. The publication of the techniques developed pursuant to §1515 will certainly help individuals and organizations increase the security of their personal communications devices.
The provisions of §6508 are targeted at helping to protect critical infrastructure from ransomware attacks. While the sense of congress statement in subsection (b) will not have any near term practical effect, the report required by subsection (c) may provide some information that will allow more proactive efforts to combat ransomware attacks in general. The most important provision in this section is found in paragraph (c)(3):
“(3) FORM.—The report submitted under paragraph (1) shall be submitted in unclassified form, but may include a classified annex.”
Counter UAS Requirements
There are four sections in this bill that address actions (cUAS) to prevent activities by unfriendly uncrewed aircraft systems:
§353. Counter unmanned aerial system threat library.
§925. Counter unmanned aerial systems task force.
§1089. Liaison with Counter Unmanned Aerial Systems Task Force.
§1090. Responding to unmanned aircraft systems incursions.
Again, these provisions are designed to provide military personnel with defensive measures against attacks (and surveillance) by unfriendly UAS. Subsection 353(c) specifically acknowledges that many of these provisions will potentially be useful to the private sector:
“(c) DISSEMINATION.—The Secretary of the Army, through the Joint Counter-Small Unmanned Aircraft Systems Office, shall establish a framework to share the information contained in the threat library required under subsection (a) with the military departments, the combatant commands, other Federal agencies, and relevant industries [emphasis added], as determined by the Secretary of the Army, in order to maintain technological superiority in aerial defense.”
Commercial Space Operations
There is one provision in the proposed amendment to HR 5009 that is going to have a potential effect on commercial space operations:
§866. Solid rocket motor industrial base.
This section requires the development of a strategy to “support the modernization or evolution of the defense industrial base of the United States to meet requirements for programs of record relating to solid rocket motors.” Again, the primary purpose is to support the development and production of military rockets, but there is an admission that solid rocket motors are also used by the commercial space program requiring a broad “assessment of commercial sector, civil sector, and Department of Defense pressures on the solid rocket motor industrial base.” {§866(d)(1)(H)}
Moving Forward
While there are provisions of objection to both sides of the aisle in this proposed amendment, it is expected that there will be some level of bipartisan support for the measure that will allow the bill to pass in the House. There is a possibility that there will be attempts to amend the bill in the Senate, but any such amendments will require the bill to come back to the House for approval of the changes. This would endanger the intent of the leadership of both bodies to complete their business this session before Christmas.