The Solarium Shift and the Architecture of Digital Deterrence

By Harlan Pryce · August 6, 2026

Harlan Pryce examines the FY2021 National Defense Authorization Act and the legislative codification of the Cyberspace Solarium Commission's strategic recommendations.

The National Defense Authorization Act is where the government’s strategic intentions finally meet its checkbook. It is a sprawling, necessary beast of a document, but if you know where to look, the margins reveal the actual trajectory of the state. In HR 6395, the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, signed into law on December 11, 2020, there is a specific movement toward a more coherent, aggressive posture in the digital domain.

Specifically, the Act "incorporates over 20 recommendations from the final report (March 2020) of the Cyberspace Solarium Commission." For those of us who spent our careers watching the Eastern Bloc through a telescope and a tapped phone line, the word "recommendations" usually suggests a polite suggestion that will be buried in a basement in Langley or Foggy Bottom. But when those recommendations are woven into an NDAA, they cease to be suggestions. They become mandates.

The Solarium Method

To understand the weight of this, one must understand what a "solarium" is in the context of intelligence and strategic planning. It is not merely a glass room for catching the sun; it is a structured exercise in imagining the unthinkable. The Cyberspace Solarium Commission was tasked with creating a layer of strategic foresight for a domain where the United States had, for too long, been playing a reactive game of whack-a-mole.

During my time in the clandestine service, the objective was always clarity: who is the asset, where is the dead drop, and what is the risk of exposure? In cyberspace, the lines are blurred. The adversary is often a ghost in the machine, operating from a keyboard in St. Petersburg or Pyongyang, shielded by layers of proxies. For years, the American approach to cyber-defense was essentially an expensive form of housekeeping—patching holes and hoping the intruders wouldn't notice the door was unlocked.

The March 2020 report mentioned in the Act sought to change that. It moved the conversation from defense to deterrence. By incorporating "over 20 recommendations" into the FY2021 NDAA, Congress signaled a willingness to move toward a "persistent engagement" model. This is tradecraft applied to the network: the idea that you do not wait for the enemy to strike your shores, but instead engage them in the gray zone, disrupting their operations before they reach the target. It is the digital equivalent of running an operation inside the adversary's own backyard.

Codifying the Invisible Front

There is a certain conservative virtue in the slow, methodical building of a defense. The fact that the Commission was reauthorized "into December 2021" suggests that the government recognized the transition from a reactive posture to a proactive one cannot happen overnight. It requires the patience of a man who knows that a well-placed asset takes years to cultivate.

The document provided is brief, but the implications are vast. When the law incorporates these recommendations, it provides the legal and budgetary cover for the intelligence community to operate with a more unified doctrine. In the old days, the friction between the military and the clandestine services could be a liability. In the cyber domain, where the speed of a strike is measured in milliseconds, that friction is a death sentence.

We are seeing the institutionalization of a new kind of border. The Eastern Bloc had the Iron Curtain—a physical, brutal line of concrete and barbed wire. The new frontier is invisible, composed of protocols, ports, and packets. But the logic of the Cold War still applies: peace is maintained not by the absence of conflict, but by the credible threat of a devastating response.

The Gap in the Record

While the Act confirms the incorporation of these recommendations, the provided text does not list the specific twenty-plus directives that were adopted. We know the fact of their inclusion, but the substance of the specific tactical shifts remains outside the scope of this particular archival snippet. This is common in the bureaucracy of defense; the high-level authorization is public, but the operational specifics remain shielded.

What we do know is that the window for hesitation has closed. By moving the Cyberspace Solarium Commission's findings into the legislative framework of the NDAA, the United States has acknowledged that cyberspace is not a supporting utility for traditional warfare, but a primary theater of conflict. For a man who spent two decades in the shadows of the old world, this is a welcome realization. The only thing more dangerous than a visible enemy is an invisible one that you have decided to ignore. The FY2021 Act ensures that we are, at the very least, looking in the right direction.