Review – HR 6309 Introduced - Cyber Deterrence and Response

Back in November Rep Pfluger (R,TX) introduced HR 6309, the Cyber Deterrence and Response Act of 2025. The bill would require the establishment of a cyber threat National Attribution Framework, and would require the National Cyber Director to designate critical cyber threat actors in accordance with procedures established under that framework. HR 6309 would also designate sanctions that the President could apply to designated critical cyber threat actors. No new funding is authorized.

Moving Forward

Pfluger is not a member of the House Foreign Affairs Committee to which this bill was assigned for primary consideration (or any on the other committees to which this bill was assigned for secondary consideration). This means that there is probably not sufficient influence to see the bill considered in Committee.

Commentary

Foreign cyber threat actors have not been discommoded by having charges filed against them by the DOJ. They know that as long as they stay out of the United States, the chances of judicial actions being taken against them are slim to none. The sanctions listed in §2(b)(2) are going to have even less effect on individual cyber threat actors as they are targeted against “each agency or instrumentality of a foreign state designated as a critical cyber threat actor”. But even individual State agencies are unlikely to be directly affected by the listed sanctions, they are more targeted on national governments. And we have seen how little practical effect sanctions have had on nations like North Korea, Iran, and Russia.

 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-6309-introduced-cyber-deterrence – subscription required.

Review - Bills Introduced – 11-25-25

Yesterday with both the House and Senate meeting in pro forma sessions, there were 33 bills introduced. Two of those bills will receive additional coverage in this blog:

HR 6309 To impose sanctions with respect to designated critical cyber threat actors, and for other purposes. Pfluger, August [Rep.-R-TX-11]

HR 6315 To amend the Help America Vote Act of 2002 to require the Election Assistance Commission to provide for the conduct of penetration testing as part of the testing and certification of voting systems and to provide for the establishment of an Independent Security Testing and Coordinated Vulnerability Disclosure Pilot Program for Election Systems. Valadao, David G. [Rep.-R-CA-22] 

 

For more information on these bills, including legislative history for similar bills in the 118^th Congress, as well as a mention in passing of an AI leadership bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-11-25-25 - subscription required.