Key Cyber and Tech Provisions Included—and Excluded—from the Final NDAA

Members of the House and Senate have reconciled their two versions of the 2023 National Defense Authorization Act, allowing for $858 billion in spending by the Department of Defense, in addition to the Department of Energy and intelligence agencies. 

The Senate Armed Services Committee released text of the final bill, along with a 748-page summary, on Tuesday, following several months of deliberation by policymakers over what has become one of few “must-pass” pieces of legislation considered each year. 

Here’s where the lawmakers ultimately landed on provisions Nextgov has been tracking with implications for cybersecurity and emerging technology.

Cybersecurity

First, the final version of the bill opts not to institute a five-year term for the director of the Cybersecurity and Infrastructure Security Agency.

The provision was included in the House-passed NDAA by Rep. Andrew Garbarino, R-N.Y., ranking member of the Homeland Security Committee’s panel on cybersecurity, to stabilize the department’s leadership, according to the congressman. It would also have clarified that the CISA director should be appointed by the president and confirmed by the Senate. 

Although this is the second year Garbarino has tried and failed to include the measure in the NDAA, it was viewed by observers as one of the less controversial cybersecurity provisions in this year’s Defense bill, along with the codification of a Cyber Diplomacy Bureau at the State Department, which did make it into the compromise released Tuesday.   

Analysts accurately predicted that key cybersecurity provisions related to increasing the government’s visibility into their vendors’ software supply chains and identifying systemically important entities for federal assistance and regulatory responsibilities would be excluded from the reconciled NDAA after opposition from industry.

The final bill also excluded a provision from Rep. Ritchie Torres, D-N.Y., that would have kept the Department of Homeland Security’s Cyber Safety Review Board on the hook for analyzing the intrusion campaign that included the infamous SolarWinds breach. After being tasked in Executive Order 14028 with examining the circumstances around that breach in order to avoid a repeat of such events, the CSRB reported instead on the security implications of Log4J vulnerabilities and has now moved on to examining the activities of the Lapsus$ ransomware group.

One of the enduring challenges lawmakers have looked to address in order to improve cybersecurity is workforce training and development. But  the final version of the bill did not include a provision establishing a cybersecurity training pilot program for eligible veterans and military spouses. The House-passed NDAA included the amendment from Rep. Chrissy Houlahan, D-Pa., and a Senate version was proposed by Sens. Maggie Hassan, D-N.H., and John Cornyn, R-Texas. 

Both chambers’ provisions were modeled on the Federal Cybersecurity Workforce Expansion Act, which was previously introduced in the Senate by Hassan and Cornyn, and in the House by Houlahan. The legislation sought to help address the cyber workforce gap by providing eligible veterans and military spouses with access to a “no cost” training program designed to bolster their professional cyber skills.

A bipartisan and bicameral initiative that did survive was the reauthorization of the National Computer Forensics Institute. The final NDAA agreement would reauthorize through 2028 the federally-funded NCFI, which serves as a national training center for digital forensics, providing law enforcement officials with the expertise needed to investigate cyber and electronic crimes, including a growing focus on dealing with encrypted devices and responding to ransomware attacks.

The House-passed NDAA included legislation that would have reauthorized the institute through 2032, but the final bill opted to go with an amendment from Sens. Dianne Feinstein, D-Calif., and Chuck Grassley, R-Iowa, that narrowed the scope of NCFI’s reauthorization. Congress passed legislation in 2017 reauthorizing NCFI through 2022, after former President Donald Trump’s proposed 2018 fiscal year budget floated the idea of eliminating the institute’s funding. 

Emerging technology

Driven by a bipartisan push to compete against China, emerging technologies largely got full throated support in the final NDAA. 

Some of the provisions focusing on innovative tech included in the bill are new pilot programs to modernize government projects in the procurement phase and advanced staff training for new technologies. 

Artificial intelligence was one of the more prominent emerging technologies featured. One specific use case slated to receive funding in 2023 is the construction and sharing of data repositories, with information from the Department of Defense, that are relevant to the further development of AI software for various warfighting operations. 

The NDAA text also clarifies AI development leadership roles among Defense’s personnel, as well as allocating more funding to generate reports outlining the usage of AI in federal intelligence operations. 

Digital transformation technologies, namely software tools to meet modernization goals, also made it into the final bill. The Space Force and the Air Force are anticipated to upgrade their software platforms to overhaul and facilitate management operations. 

An explicit prohibition on semiconductors manufactured in China was included in the final version of the NDAA, building on a larger whole-of-government push to foster domestic semiconductor manufacturing to further liberate the U.S. from economic ties with China. 

Another feature that was included in the NDAA was planning to accelerate 5G expansion within military departments. 

The provisions on emerging technology included in the final NDAA bill broadly align with amendments initially proposed under the individual versions within the House and Senate. But  notably absent from the final version of the bill was the establishment of the United States-Israel Artificial Intelligence Center. This partnership would have fostered cooperation between both nations to develop critical AI technologies, like image classification and data labeling. The excluded provision was originally a bill introduced in June 2021 by Sen. Marco Rubio, R-Fla. 

Congress will now hold a final vote on the  before sending it to the White House for the president’s signature.