Keypoints
- Tom Cotton urged Treasury to modernize aging operational technology.
- He said current tax guidance discourages needed OT security investment.
- He asked Treasury to confirm security software for industrial control systems qualifies as research under Section 41.
- He called for a safe harbor under Section 7701(e) for cybersecurity agreements with public utilities.
- He also sought to extend lease exceptions to cybersecurity service providers.
The Senate Intel Committee chair wrote to Treasury Secretary Scott Bessent about changes to spur investment in aging technology to better guard against cyberattacks.
Listen to this article
0:00
Learn more.
This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment.
Sen. Tom Cotton, R-Ark., speaks during the Senate Republicans’ news conference in the U.S. Capitol on June 23, 2026. (Bill Clark/CQ-Roll Call, Inc via Getty Images)
With the country’s operational technology underfunded, outdated and increasingly vulnerable to cyberattacks, the Senate Intelligence Committee chairman is pushing the Treasury Department to do what it can to spur investment in it.
Sen. Tom Cotton, R-Ark., said in a letter Wednesday to Treasury Secretary Scott Bessent that the department “can make better use of existing incentives in the tax code” to bolster OT, the hardware and software that underpins U.S. critical infrastructure.
“The United States is already under attack,” Cotton wrote, pointing to recent cyberattacks on community water systems in Minnesota and an Iran-backed campaign to exploit programmable logic controllers across American critical infrastructure. “Those who carry the greatest risk are least able to manage it.”
Cotton, who has led the Senate Intel panel since the beginning of the second Trump administration, made the case that federal tax guidance “discourages” investment needed to defend OT at a time when attacks on civilian infrastructure “have become a routine instrument of modern warfare.”
Some of the technology is profoundly antiquated; Cotton noted that controllers responsible for running turbines or processing lines were invented in the 1960s “and still rely on protocols designed for isolated plants, not for today’s interconnected environment.”
The problem calls for action from Treasury to spur modernization and investment in OT, Cotton said in the letter, starting with confirmation from the agency that developing security software for industrial control systems is counted as research under Section 41 of the U.S. tax code.
“A company writing code to detect an intruder inside a water plant’s controls is doing research in the ordinary sense of the word,” Cotton said. “The tax code rewards research, but it is unclear whether this research qualifies, which discourages the necessary investments in operational technology security.”
The Arkansas Republican also implored Bessent to use section 7701(e) to create a “safe harbor” for cybersecurity agreements with public utilities, clarifying that monitoring contracts would be treated as services as opposed to long-term equipment leases.
Finally, Cotton asked Bessent to extend a current exception for companies that lease security equipment to utilities to the service providers as well. Under current tax code, lessors are protected, “but a company that retains ownership and sells monitoring services receives no such protection, even though the work is essentially identical,” the letter noted. “The distinction steers small systems away from these arrangements.”
Cotton didn’t set a deadline for responses in his letter to Bessent, writing that he looked forward to working on the matter and stands “ready to discuss further.”