Tom Cotton prods Treasury for tax code tweaks to modernize OT

With the country’s operational technology underfunded, outdated and increasingly vulnerable to cyberattacks, the Senate Intelligence Committee chairman is pushing the Treasury Department to do what it can to spur investment in it.

Sen. Tom Cotton, R-Ark., said in a letter Wednesday to Treasury Secretary Scott Bessent that the department “can make better use of existing incentives in the tax code” to bolster OT, the hardware and software that underpins U.S. critical infrastructure.

“The United States is already under attack,” Cotton wrote, pointing to recent cyberattacks on community water systems in Minnesota and an Iran-backed campaign to exploit programmable logic controllers across American critical infrastructure. “Those who carry the greatest risk are least able to manage it.”

Cotton, who has led the Senate Intel panel since the beginning of the second Trump administration, made the case that federal tax guidance “discourages” investment needed to defend OT at a time when attacks on civilian infrastructure “have become a routine instrument of modern warfare.”  

Some of the technology is profoundly antiquated; Cotton noted that controllers responsible for running turbines or processing lines were invented in the 1960s “and still rely on protocols designed for isolated plants, not for today’s interconnected environment.”

The problem calls for action from Treasury to spur modernization and investment in OT, Cotton said in the letter, starting with confirmation from the agency that developing security software for industrial control systems is counted as research under Section 41 of the U.S. tax code.

“A company writing code to detect an intruder inside a water plant’s controls is doing research in the ordinary sense of the word,” Cotton said. “The tax code rewards research, but it is unclear whether this research qualifies, which discourages the necessary investments in operational technology security.”

The Arkansas Republican also implored Bessent to use section 7701(e) to create a “safe harbor” for cybersecurity agreements with public utilities, clarifying that monitoring contracts would be treated as services as opposed to long-term equipment leases. 

Finally, Cotton asked Bessent to extend a current exception for companies that lease security equipment to utilities to the service providers as well. Under current tax code, lessors are protected, “but a company that retains ownership and sells monitoring services receives no such protection, even though the work is essentially identical,” the letter noted. “The distinction steers small systems away from these arrangements.”

Cotton didn’t set a deadline for responses in his letter to Bessent, writing that he looked forward to working on the matter and stands “ready to discuss further.”