top of page
Search

Protecting Critical Infrastructure Through Prosecution: Appraising Deterrence Under Federal Criminal Law

June 2025


The September 2024 dismantling of the Flax Typhoon botnet — a campaign involving 200,000 devices targeting U.S. and global critical infrastructure — demonstrates how the government can protect critical infrastructure with law enforcement capabilities, using the judicial process to disrupt attacks on infrastructure without military power. While cyber-enabled threats to critical infrastructure are increasing, the legal tools to address them remain insufficient to deter such threats. In this paper, two federal practitioners —rooted in the “frontlines” of cybersecurity enforcement and related national security and law enforcement strategies — examine the deterrence value of the current federal framework for prosecuting crimes against critical infrastructure and propose ways to strengthen this framework to better protect the Nation.


A survey of federal statutes and sentencing guidelines reveals that there is no comprehensive federal crime for targeting critical infrastructure, which poses investigative and prosecutorial challenges in high-impact cases. This analysis leads the authors to recommend key changes: creating “chokehold” legislation with increased penalties for attacks on high-risk sectors like healthcare and energy; incorporating national security implications into sentencing; building judicial education initiatives through the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Judicial Center; and enhancing interagency data-sharing to better understand the law enforcement response to attacks on critical infrastructure. Grounded in firsthand experience, this paper offers a practitioner’s perspective on modernizing federal criminal law to deter increasingly sophisticated threats and to better protect essential systems.




About ICIT

The Institute  for Critical Infrastructure Technology (ICIT) is a nonprofit, nonpartisan, 501(c)3think tank with the mission of modernizing, securing, and making resilient critical infrastructure that provides for people’s foundational needs. ICIT takes no institutional positions on policy matters. Rather than advocate, ICIT is dedicated to being a resource for the organizations and communities that share our mission. By applying a people-centric lens to critical infrastructure research and decision making, our work ensures that modernization and security investments have a lasting, positive impact on society.


ICIT CONTACTS:

 

Parham Eftekhari

Founder and Chairman

 

Cory Simpson

Chief Executive Officer


bottom of page