H.R. 6309 — Cyber Deterrence and Response Act of 2025

This section directs the President, acting through the National Cyber Director and in coordination with other relevant federal agencies, to designate as critical cyber threat actors (1) foreign persons and foreign state agencies or instrumentalities responsible for or complicit in specified state-sponsored cyber activities reasonably likely to threaten U.S. national security, foreign policy, economic health, or financial stability—such as significant disruptions to computers or critical infrastructure, misappropriation of trade secrets or financial data, or interference with elections—and (2) persons providing significant support to such actors or knowingly using misappropriated data outside the U.S. for commercial gain. (Thus, such designations enable the President to block property or impose transaction prohibitions under IEEPA (50 U.S.C. 1702).) This section further requires the National Cyber Director, within 180 days of enactment and in consultation with specified agency heads, to submit to appropriate congressional committees a National Attribution Framework establishing uniform criteria, evidentiary standards, confidence levels, private-sector input procedures, international coordination, timelines, consistency with existing cyber policies, and processes for exemptions or waivers.