Jonathan Cedarbaum and Matt Gluck on the NDAA’s Cyber Provisions
Feb 15, 2024
auto_awesome
Jonathan Cedarbaum, Professor of Practice at GW Law School, and Matt Gluck, Research Fellow at Lawfare, discuss key cyber provisions of the NDAA for Fiscal Year 2024, including threats from Mexican criminal organizations and China, military's expanded role in protecting critical infrastructure, and what they would like to see in future versions of NDAA.
The NDAA's cyber provisions for fiscal year 2024 address threats from Mexican criminal organizations and China.
The NDAA expands the military's role in protecting critical infrastructure, particularly the electric power system.
Deep dives
Key Cyber Provisions of the NDAA for Fiscal Year 2024
The National Defense Authorization Act (NDAA) is considered must-pass legislation and has become the main vehicle for national cyber policymaking. The NDAA's cyber provisions for fiscal year 2024 address threats from Mexican criminal organizations and China. The NDAA expands the military's role in protecting critical infrastructure, particularly the electric power system. Provisions in the NDAA also aim to bolster the use of artificial intelligence (AI) systems and enhance the defense against AI attacks. The legislation includes directives for the State Department, focuses on intelligence collection and declassification, and highlights the need for additional legal authorities to fill gaps in cybersecurity regulation.
Addressing Threats from Mexican Criminal Organizations
The NDAA provision targeting Mexican criminal organizations aims to counter the flow of drugs, especially fentanyl, and the smuggling of individuals across the southern border. Fentanyl seizures at the border have increased, and the majority of fentanyl seizures occur at legal entry ports. The provision grants the Department of Defense (DOD) authority to engage in detection, monitoring, and other operations. While consultation with the Mexican government is required, consent is not necessary. The provision builds upon existing law and aligns with calls for using the military to combat Mexican drug cartels.
Addressing Risks of China Invading Taiwan
The NDAA provision related to China focuses on coordinating with Taiwanese officials and the military to enhance defensive cybersecurity activities. The provision includes defending Taiwanese military networks, infrastructure, and systems, as well as joint cybersecurity training and exercises. The NDAA supports the use of US technology to bolster Taiwan's cybersecurity capabilities. The provision complements the DOD's own cyber strategy, particularly its goal of protecting the cyber domain with allies and partners.
Expanding Military's Role in Protecting Critical Infrastructure
The NDAA expands the military's role in protecting critical infrastructure, such as the electric power system. The legislation authorizes the transfer of technology from the DOD to the private sector, particularly in areas like monitoring and responding to cyber threats. Pilot programs are established to enhance critical infrastructure security, including the microelectronics supply chain and military installations in the event of large-scale cyber attacks. The NDAA also seeks to improve the efficiency and effectiveness of classification and declassification processes.
The National Defense Authorization Act, or NDAA, is considered must-pass legislation and is increasingly becoming the only reliable vehicle for national cyber policymaking. Lawfare Senior Editor Stephanie Pell sat down with Jonathan Cedarbaum, Professor of Practice at George Washington University Law School and Book Review Editor at Lawfare, and Matt Gluck, Research Fellow at Lawfare, to talk about the key cyber provisions of the NDAA for Fiscal Year 2024. They talked about new cyber provisions that address threats from Mexican criminal organizations and China, along with how some of the new cyber provisions expand the military’s role in protecting against threats to critical infrastructure. They also discussed what Jonathan and Matt would like to see in future versions of the NDAA.