Congress toughens penalties for cyberattacks on power grids, hospitals, water systems

What it does

This bill increases criminal penalties for computer fraud targeting critical infrastructure from current levels to a mandatory minimum of 30 years imprisonment (up to life), and authorizes the President to impose sanctions on foreign persons who knowingly access U.S. critical infrastructure to harm national security or citizens. Sanctions include asset freezes and visa revocation. The bill benefits national security and infrastructure protection; ordinary citizens benefit indirectly through stronger deterrence against cyberattacks on power grids, water systems, hospitals, and other essential services.

Why we flagged it

The bill's core mechanism is increasing criminal penalties and authorizing executive sanctions for cyberattacks on critical infrastructure. It is a straightforward law-enforcement and national-security measure with no hidden riders or private carve-outs.

What the text implies

• Presidential sanction authority is broad and discretionary; the 'knowingly' standard includes constructive knowledge ('should have known'), which may capture actors with indirect involvement or ambiguous intent.
• The 180-day waiver provision allows the President to suspend sanctions on national-security grounds with only 15-day congressional notice, concentrating power in the executive branch with limited legislative oversight.
• Asset-blocking authority under IEEPA may affect U.S. persons' transactions with sanctioned foreign entities, creating compliance burdens on financial institutions and businesses.
• The bill does not define 'critical infrastructure' inline; it cross-references section 1016(e) of the USA PATRIOT Act (Public Law 107–56), which covers a broad range of sectors (energy, water, transportation, communications, financial services, etc.), potentially capturing foreign persons with minimal connection to sensitive systems.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill strengthens deterrence and enforcement against cyberattacks on critical infrastructure (power, water, communications, hospitals) that directly threaten public safety and essential services. Ordinary citizens benefit from reduced risk of infrastructure disruption, though the benefit is indirect and depends on enforcement effectiveness.

Named in the bill

Department of Justice, Executive Branch / President, Foreign persons (sanctioned parties), U.S. critical infrastructure operators, International Emergency Economic Powers Act (IEEPA), USA PATRIOT Act Section 1016(e), Immigration and Nationality Act

Where it stands

3 cosponsors: 2 Republicans, 1 Democrats.

• May 8, 2025 — Introduced · Congress.gov: “Introduced in House”
• May 8, 2025 — Referred to House Committee on Foreign Affairs and House Committee on the Judiciary · Congress.gov: “Referred to the Committee on the Judiciary, and in addition to the Committee on Foreign Affairs, for a period…”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.