National Defense Authorization Act for Fiscal Year 2024, Section 1507 ("Review and plan relating to cyber red teams of Department of Defense")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws
• Most recent activity: Enacted
• Most recent activity date: 2023-12-22

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• AI possessing dangerous capabilities
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of approximately 3-4 subdomains, with primary focus on AI system security (2.2), cyberattacks and weapons (4.2), dangerous AI capabilities (7.2), and lack of robustness (7.3). Coverage is concentrated in security and AI safety domains related to cyber defense capabilities.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document exclusively governs the National Security sector, specifically the Department of Defense's cyber red team capabilities. It does not regulate AI use in commercial or civilian sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding statutory provision enacted by the United States Congress as part of the National Defense Authorization Act for Fiscal Year 2024, with mandatory requirements and specific deadlines for Department of Defense compliance.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 1507 of the National Defense Authorization Act for Fiscal Year 2024, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Governance_Actor
• Entities: Department of Defense; Principal Cyber Advisor to the Secretary of Defense; Chief Information Officer of the Department of Defense; Director of Operational Test and Evaluation; Commander of the United States Cyber Command; Secretary of Defense; cyber red teams of the Department of Defense; military departments; Defense Agencies
• Summary: The document explicitly targets Department of Defense entities and officials who must conduct reviews, develop plans, and implement cyber red team capabilities, including those related to AI and machine learning threats.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress; congressional defense committees
• Summary: Congress enforces compliance through mandatory reporting requirements to congressional defense committees and oversight of implementation through annual reports.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Director of Operational Test and Evaluation; congressional defense committees
• Summary: The Director of Operational Test and Evaluation is explicitly tasked with monitoring and reporting on implementation progress annually through 2031, with reports submitted to congressional defense committees for oversight.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Verify and Validate
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Operate and Monitor stage of the AI lifecycle, with some coverage of Plan and Design and Verify and Validate stages. It focuses on ensuring cyber red teams have capabilities to test and evaluate AI/ML-based cyber threats, requiring ongoing monitoring and assessment of capacity and capability gaps.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document explicitly mentions artificial intelligence and machine learning in the context of cyber threats that red teams must be capable of emulating and defending against. It does not define specific AI system types or use compute thresholds, focusing instead on operational capabilities needed to address AI-enabled cyber threats.