Referred to the Committee on the Judiciary, and in addition to the Committee on Foreign Affairs, for a period to be subsequently determined by the Speaker, in each case for consid…
The bill raises criminal penalties under the Computer Fraud and Abuse Act for offenses involving critical infrastructure, adding fines and imprisonment of not less than 30 years or life for such offenses. It also directs the President to impose IEEPA-based asset-blocking sanctions and immigration penalties (inadmissibility and visa revocation) on foreign persons who knowingly access or attempt to access critical infrastructure to harm U.S. national security or the safety of lawful permanent residents, with limited waiver, rulemaking, and oversight provisions and statutory definitions.
Severity of criminal penalties versus proportionality and civil liberties
Relative to its intended legislative type, this bill is a substantive policy change that clearly defines its principal actions (increasing criminal penalties for critical infrastructure-related computer offenses and creating mandatory sanctions authorities against foreign persons) and integrates those actions with existing statutory authorities.
The bill raises criminal penalties under the Computer Fraud and Abuse Act for offenses involving critical infrastructure, adding fines and imprisonment of not less than 30 years or life for such offenses.
It also directs the President to impose IEEPA-based asset-blocking sanctions and immigration penalties (inadmissibility and visa revocation) on foreign persons who knowingly access or attempt to access critical infrastructure to harm U.S. national security or the safety of lawful permanent residents, with limited waiver, rulemaking, and oversight provisions and statutory definitions.
Narrow national security focus helps, but very severe criminal penalties and broad sanctioning/immigration effects create legal and political friction.
Relative to its intended legislative type, this bill is a substantive policy change that clearly defines its principal actions (increasing criminal penalties for critical infrastructure-related computer offenses and creating mandatory sanctions authorities against foreign persons) and integrates those actions with existing statutory authorities. It supplies concrete mechanisms and a usable implementation path for the sanctions provisions but omits fiscal/resourcing statements and detailed procedural safeguards or measurement/oversight provisions that would be expected given the scope of the authorities it creates.
Severity of criminal penalties versus proportionality and civil liberties
These are examples from the analysis, not a ranked list of the most-affected groups.
Severity of criminal penalties versus proportionality and civil liberties
Likely supportive of stronger defenses against attacks on infrastructure, but cautious about civil liberties, overcriminalization, and executive power.
Will want narrow definitions, due process protections, and carve-outs for security researchers and legitimate activity.
Supports strengthening legal consequences for cyberattacks on critical systems while seeking clearer scope and oversight.
Will weigh national security benefits against proportionality and diplomatic consequences.
Generally favorable because the bill increases penalties and gives the President strong tools against foreign cyber threats.
May still want guardrails to ensure penalties target malicious foreign and domestic actors, not ordinary private-sector activity.
Reached or meaningfully advanced
Reached or meaningfully advanced
Still ahead
Still ahead
Still ahead
Narrow national security focus helps, but very severe criminal penalties and broad sanctioning/immigration effects create legal and political friction.
The bill has not accumulated any surfaced votes yet.
Severity of criminal penalties versus proportionality and civil liberties
Narrow national security focus helps, but very severe criminal penalties and broad sanctioning/immigration effects create legal and politic…
Relative to its intended legislative type, this bill is a substantive policy change that clearly defines its principal actions (increasing criminal penalties for critical infrastructure-related computer offenses and cre…
Go beyond the headline summary with full stakeholder mapping, legislative design analysis, passage barriers, and lens-by-lens tradeoff breakdowns.