Review – HR 6309 Introduced - Cyber Deterrence and Response

Back in November Rep Pfluger (R,TX) introduced HR 6309, the Cyber Deterrence and Response Act of 2025. The bill would require the establishment of a cyber threat National Attribution Framework, and would require the National Cyber Director to designate critical cyber threat actors in accordance with procedures established under that framework. HR 6309 would also designate sanctions that the President could apply to designated critical cyber threat actors. No new funding is authorized.

Moving Forward

Pfluger is not a member of the House Foreign Affairs Committee to which this bill was assigned for primary consideration (or any on the other committees to which this bill was assigned for secondary consideration). This means that there is probably not sufficient influence to see the bill considered in Committee.

Commentary

Foreign cyber threat actors have not been discommoded by having charges filed against them by the DOJ. They know that as long as they stay out of the United States, the chances of judicial actions being taken against them are slim to none. The sanctions listed in §2(b)(2) are going to have even less effect on individual cyber threat actors as they are targeted against “each agency or instrumentality of a foreign state designated as a critical cyber threat actor”. But even individual State agencies are unlikely to be directly affected by the listed sanctions, they are more targeted on national governments. And we have seen how little practical effect sanctions have had on nations like North Korea, Iran, and Russia.

 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-6309-introduced-cyber-deterrence – subscription required.