Can Congress Do Anything to Curb Threats to Digital Infrastructure?

Why it Matters

America's critical digital infrastructure — the data centers storing sensitive federal data, the telecommunications networks carrying classified communications, and the space-based systems underpinning military and civilian operations — sits at the center of an intensifying geopolitical contest. The House Homeland Security Committee has scheduled a hearing for April 29, 2026 to examine whether the Department of Homeland Security's Sector Risk Management Agency is equipped to protect the communications and IT sectors from threats that members of Congress have publicly described as already embedded in U.S. networks.

As the @HomelandGOP account noted in a post featuring Rep. Mark Green, "If you look at Volt Typhoon, Salt Typhoon, they're in our infrastructure. They're in our telecommunications systems." That framing, invoking two Chinese state-sponsored hacking campaigns that U.S. officials have linked to telecom and utility network intrusions, sets the tone for what the committee is expected to probe.

The Big Picture

DHS's Sector Risk Management Agency (SRMA) assigns the department lead responsibility for coordinating risk management across the communications and IT sectors. But critics and legislators have argued that the statutory framework underpinning that role has not kept pace with the scale and sophistication of modern threats, particularly as data centers, satellite systems, and AI computing infrastructure have become central to both economic and national security.

The National Risk Management Act of 2023 represents the most direct legislative attempt to address that gap. Introduced in the Senate by Sen. Maggie Hassan (D-NH) with Republican co-sponsorship from Sen. Mitt Romney (R-UT), the bill would require the Cybersecurity and Infrastructure Security Agency (CISA) to establish a recurring process to identify and assess risks to critical infrastructure; collect information from Sector Risk Management Agencies; and compel the President to deliver a national critical infrastructure resilience strategy to Congress. The Senate bill advanced to the floor calendar, but the House companion, H.R. 5439, remains in committee.

What They're Saying

Committee-adjacent communications in recent weeks have reflected the urgency members attach to these issues. Rep. Tony Gonzales (R-TX) stated plainly that "China and our adversaries will stop at nothing to undermine our networks," calling cyber infrastructure a core national security priority. On the Democratic side, Rep. Norma J. Torres (D-CA) introduced the Protecting America's Cybersecurity Act, which she described as a vehicle to block DOGE from interfering in cybersecurity defenses, restore CISA staffing, and return congressional oversight to national cyber policy.

Torres's bill reflects a broader Democratic concern that CISA, the agency at the center of the SRMA framework, has been weakened by the administration's personnel decisions. That tension is likely to surface during the hearing, as members on both sides of the aisle weigh in on whether DHS has the capacity to execute the SRMA role as currently structured.

Lobbying

Over the past year, companies spanning data center infrastructure, telecommunications, cybersecurity, space systems, and AI computing have collectively invested millions of dollars in federal advocacy on topics central to the hearing.

Equinix Inc., one of the largest data center operators in the country, has filed lobbying disclosures totaling more than $2.1 million across 2025 and into the first quarter of 2026, covering IT modernization, digital infrastructure, data centers, and AI in the federal marketplace. CoreWeave Inc. has also been active, lobbying on AI computing and data centers and specifically referencing executive orders on artificial intelligence infrastructure.

On the telecommunications side, Verizon Communications has maintained a steady lobbying presence across all four quarters of 2025 and into 2026, covering communications policy, spectrum, advanced network deployment, and cybersecurity. Ligado Networks has separately focused on educating members of Congress specifically on telecommunications networks.

Space and satellite companies have been similarly engaged. Astranis Space Technologies has filed disclosures in three consecutive quarters through the first quarter of 2026, while Kepler Communications has lobbied on Space Development Agency programs and NASA satellite communications funding.

Cybersecurity firms have also been pressing their case. Tenable Inc. has lobbied on DHS's Continuous Diagnostics and Mitigation Program and fiscal year 2026 appropriations for DHS. Wiz Inc. has advocated for additional CISA funding for advanced cloud protection tools. BlueVoyant Government Solutions has filed disclosures in each of the past five quarters on supply chain security.

OpenAI has been among the most active spenders, reporting more than $1 million in lobbying expenditures in the first quarter of 2026 alone on AI, cloud computing infrastructure, and cybersecurity, a figure that reflects how deeply the AI industry has become intertwined with the critical infrastructure debate.

PAC contributions from these sectors have also flowed to relevant lawmakers. The Verizon PAC has distributed $47,500 to members over the past two years, while the Tenable PAC has contributed $33,500, including $3,000 to Rep. Bennie Thompson (D-MS), the ranking member on the Homeland Security Committee, and $2,000 to former Chairman Rep. Michael McCaul (R-TX).

The Bottom Line

The administration has moved aggressively on AI infrastructure through executive action, issuing orders on artificial intelligence infrastructure and the so-called Genesis Mission. Congress has been simultaneously debating CISA's budget and staffing levels. And the Salt Typhoon and Volt Typhoon intrusion campaigns have kept Chinese cyber threats at the top of the national security agenda.

Whether DHS's SRMA framework, which was designed for an earlier era of critical infrastructure risk, can be modernized fast enough to match the pace of those threats is the central question the committee will take up on April 29.

Access the Legis1 platform for comprehensive political news, data, and insights.