Public-private cybersecurity partnership for highly capable artificial intelligence systems

(a) Establishment required Not later than 180 days after the date of the enactment of this Act, the Assistant Secretary of Defense for Cyber Policy shall establish a public-private partnership body to address cybersecurity and physical security threats and vulnerabilities to highly capable artificial intelligence and machine learning systems. (b) Forum for engagement The public-private partnership body established under subsection (a) shall serve as a forum for engagement between the Department of Defense and commercial industry partners to align and enhance cybersecurity and physical security frameworks and practices applicable to both national security systems and artificial intelligence and machine learning systems at risk from sophisticated state actors. (c) Purpose The public-private partnership body developed under subsection (a) shall— (1) convene regular engagements to discuss cybersecurity and physical security threats and vulnerabilities specific to highly capable artificial intelligence and machine learning systems, with a focus on both current and emerging threats posed by state-sponsored cyber actors; (2) facilitate the development, sharing, and alignment of best practices and robust cybersecurity and physical security frameworks between the Department and commercial industry to protect artificial intelligence and machine learning systems; (3) promote collaborative threat intelligence sharing between the Department and commercial entities, with particular attention to vulnerabilities in artificial intelligence and machine learning systems used in critical infrastructure, defense operations, and sensitive national security functions; and (4) develop recommendations for cybersecurity and physical security policy enhancements aimed at safeguarding artificial intelligence and machine learning technologies from state-sponsored cyber attacks and report findings and policy recommendations to Congress on an annual basis. (d) Participants The public-private partnership body developed under subsection (a) shall include representatives from— (1) the Department of Defense, including— (A) the Office of the Assistant Secretary of Defense for Cyber Policy; (B) the Under Secretary of Defense for Intelligence and Security; (C) the Chief Information Officers of the Department of Defense and the Armed Forces; (D) the Chief Digital and Artificial Intelligence Officer of the Department of Defense; (E) the Defense Advanced Research Projects Agency; (F) the National Security Agency; (G) United States Cyber Command; (H) the Defense Cyber Crime Center; and (I) such other entities in the Department of Defense and military departments with responsibilities for cybersecurity or artificial intelligence systems as the Assistant Secretary considers relevant; (2) commercial industry companies with expertise in highly capable artificial intelligence and machine learning systems, or cybersecurity or physical security practices, including— (A) cloud computing and artificial intelligence service providers; (B) cybersecurity companies; (C) artificial intelligence research and development companies; (D) telecommunications companies; and (E) such other industry leaders as the Assistant Secretary identifies as relevant and appropriate; and (3) federally funded research and development centers, national laboratories, and academic institutions with demonstrated expertise in highly capable artificial intelligence and machine learning systems, cybersecurity or physical security practices. (e) Reporting requirements Not later than one year after the date of the establishment of the public-private partnership body under subsection (a), and not less frequently than once each year thereafter until December 1, 2030, the Assistant Secretary shall submit to the congressional defense committees a report summarizing— (1) the key finding from the engagements held under subsection (c)(1), including any identified cybersecurity or physical security vulnerabilities in artificial intelligence and machine learning systems; (2) recommendations for enhancing cybersecurity or physical security policy and practices to protect artificial intelligence and machine learning systems across both the Department and commercial sectors; and (3) an analysis of the progress made in aligning Department and commercial cybersecurity and physical security frameworks to address state-sponsored cyber threats.

(a) Establishment required Not later than 180 days after the date of the enactment of this Act, the Assistant Secretary of Defense for Cyber Policy shall establish a public-private partnership body to address cybersecurity and physical security threats and vulnerabilities to highly capable artificial intelligence and machine learning systems. (b) Forum for engagement The public-private partnership body established under subsection (a) shall serve as a forum for engagement between the Department of Defense and commercial industry partners to align and enhance cybersecurity and physical security frameworks and practices applicable to both national security systems and artificial intelligence and machine learning systems at risk from sophisticated state actors. (c) Purpose The public-private partnership body developed under subsection (a) shall— (1) convene regular engagements to discuss cybersecurity and physical security threats and vulnerabilities specific to highly capable artificial intelligence and machine learning systems, with a focus on both current and emerging threats posed by state-sponsored cyber actors; (2) facilitate the development, sharing, and alignment of best practices and robust cybersecurity and physical security frameworks between the Department and commercial industry to protect artificial intelligence and machine learning systems; (3) promote collaborative threat intelligence sharing between the Department and commercial entities, with particular attention to vulnerabilities in artificial intelligence and machine learning systems used in critical infrastructure, defense operations, and sensitive national security functions; and (4) develop recommendations for cybersecurity and physical security policy enhancements aimed at safeguarding artificial intelligence and machine learning technologies from state-sponsored cyber attacks and report findings and policy recommendations to Congress on an annual basis. (d) Participants The public-private partnership body developed under subsection (a) shall include representatives from— (1) the Department of Defense, including— (A) the Office of the Assistant Secretary of Defense for Cyber Policy; (B) the Under Secretary of Defense for Intelligence and Security; (C) the Chief Information Officers of the Department of Defense and the Armed Forces; (D) the Chief Digital and Artificial Intelligence Officer of the Department of Defense; (E) the Defense Advanced Research Projects Agency; (F) the National Security Agency; (G) United States Cyber Command; (H) the Defense Cyber Crime Center; and (I) such other entities in the Department of Defense and military departments with responsibilities for cybersecurity or artificial intelligence systems as the Assistant Secretary considers relevant; (2) commercial industry companies with expertise in highly capable artificial intelligence and machine learning systems, or cybersecurity or physical security practices, including— (A) cloud computing and artificial intelligence service providers; (B) cybersecurity companies; (C) artificial intelligence research and development companies; (D) telecommunications companies; and (E) such other industry leaders as the Assistant Secretary identifies as relevant and appropriate; and (3) federally funded research and development centers, national laboratories, and academic institutions with demonstrated expertise in highly capable artificial intelligence and machine learning systems, cybersecurity or physical security practices. (e) Reporting requirements Not later than one year after the date of the establishment of the public-private partnership body under subsection (a), and not less frequently than once each year thereafter until December 1, 2030, the Assistant Secretary shall submit to the congressional defense committees a report summarizing— (1) the key finding from the engagements held under subsection (c)(1), including any identified cybersecurity or physical security vulnerabilities in artificial intelligence and machine learning systems; (2) recommendations for enhancing cybersecurity or physical security policy and practices to protect artificial intelligence and machine learning systems across both the Department and commercial sectors; and (3) an analysis of the progress made in aligning Department and commercial cybersecurity and physical security frameworks to address state-sponsored cyber threats.