Protecting Critical Infrastructure Act
- Sponsor
- Rep. Fallon, Pat [R-TX-4]
- Committees
- Foreign Affairs Committee (primary)
- Last action
- May 8, 2025
Bottom line
The bill aims to deter cyberattacks on U.S. critical infrastructure by imposing severe criminal sentences and establishing a robust sanctions framework against foreign actors.
What it actually does
This bill significantly increases criminal penalties for computer fraud and related offenses targeting critical infrastructure, imposing potential life imprisonment. It also establishes a new sanctions regime, requiring the President to block assets and deny entry to foreign persons who knowingly access critical infrastructure to harm U.S. national security or citizen safety. The bill grants the President waiver authority for national security interests and mandates the promulgation of implementing regulations.
Proponents argue
Proponents argue that current penalties for cyberattacks on critical infrastructure are insufficient to deter sophisticated state-sponsored or criminal actors. They contend that increasing prison sentences to life and implementing strict financial and travel sanctions will send a clear message, enhance national security, protect vital services, and safeguard American citizens from potentially devastating cyber disruptions.
Opponents contend
Opponents might raise concerns about the broad definition of 'critical infrastructure' and the potential for overreach in applying severe penalties. Some may argue that while deterrence is important, the effectiveness of increased prison sentences against foreign state actors is questionable, and that a focus on proactive defense and international cooperation might be more impactful than solely punitive measures.
The bill is short and relatively straightforward, making it accessible for a quick read and initial evaluation.
Section 2
Increased Penalties for Computer Fraud Involving Critical Infrastructure
This section amends the Computer Fraud and Abuse Act (18 U.S.C. 1030(c)) to significantly increase the penalties for computer fraud and related offenses. Specifically, it adds a new category of offense that, if it involves critical infrastructure, carries a penalty of a fine and imprisonment for not less than 30 years or for life. This drastically escalates the potential punishment for cyberattacks on essential services.
Supporters argue
Supporters argue that these increased penalties are crucial for deterring malicious actors, especially those from nation-states or sophisticated criminal organizations, from targeting vital U.S. critical infrastructure. They believe that the threat of life imprisonment will serve as a powerful disincentive, thereby protecting national security and public safety.
Critics contend
Critics may contend that while the intent is valid, such severe penalties might not effectively deter state-sponsored actors who operate with state protection. They might also argue that the focus should be more on prevention and rapid response rather than solely on punitive measures, which may be difficult to enforce against foreign entities.
Tradeoffs
The provision balances the desire for strong deterrence against the practical challenges of prosecuting and imposing such sentences on all potential actors, particularly those operating outside U.S. jurisdiction. There's also a tension between the severity of punishment and the potential for unintended consequences in complex cybercrime cases.
Section 3(a) and (b)
Sanctions for Foreign Persons Accessing Critical Infrastructure
This section mandates the President to impose sanctions on any foreign person who knowingly accesses or attempts to access U.S. critical infrastructure with the intent to harm national security, defense, or the safety of U.S. citizens. The sanctions include blocking all property and interests in property of the foreign person within U.S. jurisdiction, and for individuals, making them inadmissible to the U.S. and revoking any existing visas. This creates a powerful economic and travel deterrent against foreign cyber threats.
Section 3(c)
Presidential Waiver Authority for Sanctions
This section grants the President the authority to waive the application of sanctions imposed under this Act on a case-by-case basis for periods not exceeding 180 days. Such a waiver can only be exercised if the President certifies to the appropriate congressional committees, 15 days prior to the waiver taking effect, that it is vital to the national security interests of the United States. This provides executive flexibility in foreign policy and national security matters.
The definition of 'critical infrastructure' is not provided within the bill text itself but is referenced externally to 'section 1016(e) of Public Law 107-56 (42 U.S.C. 5195c(e))).'
Section 2 and Section 3(a)
Why it matters:This is standard legislative drafting practice to avoid redundancy and ensure consistency with existing legal definitions. It's not necessarily evasive, but it does require extra effort for a complete understanding.
Case for: Referencing an existing, established definition ensures consistency across federal law and avoids creating conflicting or redundant definitions. This streamlines the legislative process and leverages existing legal frameworks.
Case against: For a casual reader, the reliance on external definitions makes the bill less self-contained and harder to fully comprehend without additional legal research. It can obscure the full scope of what constitutes 'critical infrastructure' under this Act.
Estimated impact: The scope of 'critical infrastructure' is broad, encompassing sectors like energy, water, telecommunications, and financial services, meaning the bill's impact on these sectors and related cyber activities is extensive.
The bill grants the President authority to impose asset blocking sanctions by exercising powers under the International Emergency Economic Powers Act (IEEPA) and explicitly states that the President may use authorities provided under sections 203 and 205 of IEEPA for implementation.
Section 3(b)(1)(A) and Section 3(d)
Why it matters:This is standard legislative practice to grant executive authority by referencing existing legal frameworks, rather than re-codifying extensive powers. It's efficient but requires familiarity with IEEPA.
Case for: Leveraging IEEPA provides the President with a well-established and robust legal framework for imposing and enforcing economic sanctions, ensuring rapid and effective implementation without needing to create new mechanisms from scratch.
Case against: The broad powers granted under IEEPA, including the ability to investigate, regulate, and prohibit transactions, are extensive. Incorporating these by reference means the bill grants significant executive authority without fully detailing it within its own text, which some might see as reducing transparency.
Estimated impact: IEEPA grants broad powers to block assets, prohibit transactions, and impose civil and criminal penalties, giving the President substantial leverage against sanctioned foreign persons.