Biden signs $858 billion defense policy bill into law, expanding gov't cyber operations

President Joe Biden signed a $858 billion defense policy bill on Friday, conferring more power — and obligations — on U.S. Cyber Command.

The White House announced the compromise National Defense Authorization Act in a press release.

The measure approves an additional $44 million for Cyber Command’s “hunt forward” missions. Since 2018, the digital warfighting unit has deployed such teams as part of its “persistent engagement” strategy 38 times to 21 foreign countries to uncover malware and other vulnerabilities over 60 networks.

The bill states that if the president determines there is an “active, systemic and ongoing campaign of attacks in cyberspace by a foreign power” against the U.S. government or the country’s critical infrastructure, CYBERCOM can conduct offensive operations in response, with presidential approval.

The massive legislation, which outlines military spending and policy priorities annually, also directs the defense secretary to brief congressional lawmakers annually on the relationship between CYBERCOM and the National Security Agency.

It also mandates a biennial, unclassified report through the 2032 election cycle on the command’s election security efforts.

The bipartisan bill creates an assistant secretary of cyber policy at the Pentagon – a move the administration previously objected to.

It also codifies the State Department’s new cybersecurity bureau, helmed by the country’s first cyber ambassador.

In a statement accompanying the signing, Biden cited certain provisions that “raise constitutional concerns or questions of construction,” including language “for timely sharing of tactical and operational cybersecurity threat and security vulnerability information and planned or ongoing counterintelligence operations or targeted collection efforts with the legislative branch.”

He said the section related to cybersecurity is “designed to ensure that the Congress has information concerning cybersecurity and counterintelligence threats" when they relate specifically to Congress itself.