William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Division A, Title V, Section 589F ("Study on cyberexploitation and online deception of members of the Armed Forces and their families")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws
• Most recent activity: Enacted
• Most recent activity date: 2021-01-01

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• AI system security vulnerabilities
• False or misleading information
• Pollution of information ecosystem
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• AI possessing dangerous capabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Exposure to toxic content

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document primarily addresses risks from malicious actors (4.1, 4.2, 4.3) with good coverage, focusing on cyberexploitation, disinformation, and fraud targeting military personnel. It also covers AI system capabilities (7.2) through assessment of deepfake technology, misinformation (3.1, 3.2), privacy compromise (2.1), and security vulnerabilities (2.2). Coverage is concentrated in security, malicious use, and information integrity domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Finance & Insurance
• Educational Services
• Health Care & Social Assistance

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs National Security sector activities, specifically the Department of Defense's assessment of cyber threats to military personnel. It does not regulate private sector AI development or deployment across other economic sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative provision enacted by the U.S. Congress as part of the National Defense Authorization Act, with mandatory language requiring the Secretary of Defense to complete a study and submit a report.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is a section of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Governance_Actor, Affected_Stakeholder
• Entities: Secretary of Defense; Department of Defense; members of the Armed Forces and their families
• Summary: The document directs the Secretary of Defense to conduct a study on cyberexploitation targeting members of the Armed Forces and their families. The targets include both the government entity responsible for compliance (DoD) and the affected population (military personnel and families).

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Committees on Armed Services of the House of Representatives and the Senate
• Summary: The Congressional Armed Services Committees serve as the enforcement mechanism through their oversight authority, requiring the Secretary of Defense to submit a report on the study findings.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Committees on Armed Services of the House of Representatives and the Senate
• Summary: The Congressional Armed Services Committees monitor compliance through the mandatory reporting requirement, receiving both unclassified and potentially classified information about the study findings.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document does not directly govern AI development lifecycle stages, but rather mandates a study assessing the deployment and operational impacts of AI technologies (social media algorithms, deepfakes) used maliciously against military personnel. The focus is on understanding how deployed AI systems are being weaponized rather than governing their development.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• Generative AI

Technical Scope Summary

The document explicitly mentions machine learning techniques in the context of deepfakes and references social media algorithms. It does not define AI models or systems formally, nor does it mention frontier AI, general purpose AI, foundation models, or compute thresholds. The focus is on specific AI applications (deepfakes, algorithms) rather than AI systems broadly.