FY2023 NDAA Expands AARO: UAP Redefined, Whistleblower Protections Added

Why does “UFO disclosure” feel like it’s always one hearing away, one leaked slide away, one viral clip away, and yet you still can’t point to the moment where anything actually, concretely changed?

If you follow UAP disclosure closely, you’ve probably felt the whiplash: one camp insists “disclosure happened,” another shrugs “nothing changed,” and both are reacting to the loudest moments. The real shift was quieter, procedural, and easy to miss if you’re only watching headlines.

President Biden signed the FY2023 National Defense Authorization Act (NDAA) into law on December 23, 2022, and that matters because the NDAA is the annual defense policy law Congress uses to force structure, reporting, and oversight across the Pentagon. FY2023 did not just authorize spending. It quietly changed the UAP policy machinery by expanding the framework around the Pentagon’s UAP effort, broadening what gets counted as a case by treating UAP as an all-domain issue, and formalizing clearer reporting procedures that set expectations for future public outputs (see Pub. L. 117-263, https://www.govinfo.gov/content/pkg/PLAW-117publ263/pdf/PLAW-117publ263.pdf).

That’s the tension this article resolves: public expectations of “answers” collide with what laws actually do. Statutes don’t magically produce a single satisfying reveal. They build plumbing: scope, pathways for information to move, and oversight artifacts like mandated reports that create a paper trail you can track over time.

Timeline-wise, FY2022 is widely characterized as the first significant modern legislative step that defined how the U.S. government should handle UAP. FY2023 is the major follow-on expansion, not a fresh start. If you want signal instead of hype, the trick is to watch what Congress locked into process, then measure everything else against that.

You’ll walk away with a practical lens for interpreting UAP news: focus on statutory scope, reporting pathways, and oversight outputs, not the hottest take of the week.

To see what actually shifted, it helps to start where Congress starts: what counts as a case, who can report what, and what the government is required to produce for oversight.

UAP Redefined and Broadened

The biggest FY2023 “disclosure” move wasn’t a photo drop or a surprise briefing. It was redefining what legally counts as a UAP case, which quietly changes what gets captured, investigated, and briefed. That shift landed in the FY2023 NDAA (Pub. L. 117-263, https://www.govinfo.gov/content/pkg/PLAW-117publ263/pdf/PLAW-117publ263.pdf).

In practice, a statutory definition is a policy lever, not a vocabulary lesson. When Congress writes “unidentified anomalous phenomena” into the AARO statute (codified at 50 U.S.C. § 3373, https://www.law.cornell.edu/uscode/text/50/3373), it sets the boundary for jurisdiction (who owns the case), data collection (what gets logged), and reporting duties (what must be briefed to overseers). If an incident fits the definition, it enters the UAP pipeline; if it doesn’t, it can be routed somewhere else and never show up in UAP counts.

Prior statutory definition (air only): “The term ‘unidentified aerial phenomena’ means airborne objects that are not immediately identifiable.” (10 U.S.C. § 113 note, “Establishment of Anomaly Surveillance and Resolution Office,” as added by Pub. L. 117-81, div. A, title XVI, § 1683; see Pub. L. 117-81, https://www.govinfo.gov/content/pkg/PLAW-117publ81/pdf/PLAW-117publ81.pdf.)

Plain English: the old funnel started and ended in the air. If it wasn’t an airborne object, it wasn’t even eligible to be treated as a UAP case under the statute, no matter how strange it looked on radar or video.

FY2023 updated definition (all-domain): “The term ‘unidentified anomalous phenomena’ means any of the following: (A) Unidentified aerial phenomena. (B) Transmedium objects or devices. (C) Submerged objects or devices.” (50 U.S.C. § 3373, “All-domain Anomaly Resolution Office,” as added and amended by Pub. L. 117-263, div. A, title XVI; see https://www.law.cornell.edu/uscode/text/50/3373 and Pub. L. 117-263, https://www.govinfo.gov/content/pkg/PLAW-117publ263/pdf/PLAW-117publ263.pdf.)

Plain English: the funnel got wider. “Aerial” is now just one bucket; Congress explicitly adds “transmedium” and “submerged,” which pulls in cases tied to the sea and cross-domain movement, not just “something in the sky.” That’s a bigger intake, even if nothing about the underlying world has changed.

That’s also why the online line you’ll see a lot, “not initially understood by the sensor,” needs a label: it’s an imperfect paraphrase. The enacted statutory phrasing is “not immediately identifiable” (in the prior definition quoted above), and the FY2023 update broadens the domains (air, underwater, and transmedium), not the idea that a particular sensor “doesn’t understand” what it’s seeing.

Once you expand the definition beyond airborne, you don’t just get “more reports.” You get a different mix of reports: maritime contacts, cross-domain tracks, and ambiguous “transmedium” incidents that would have been out of scope under an air-only definition. NASA made the same kind of scoping point in its Sept. 14, 2023 UAP Independent Study Team report (see NASA, “An Independent Study on Unidentified Anomalous Phenomena,” Sept. 14, 2023, https://www.nasa.gov/ames/research/uap), describing a broadened UAP scope beyond simply “objects in the sky,” which is a useful reminder that what you choose to count changes what you end up debating.

1. Check which definition is being used when someone cites a “rise in UAP reports” (air-only vs. all-domain).
2. Ask whether the count includes “submerged” and “transmedium” cases, because FY2023 explicitly pulls those into the statutory funnel.
3. Separate “more cases logged” from “more cases explained,” because a broader intake increases volume and variety without proving any non-human conclusion.

The practical takeaway is simple: “more UAP reports” can reflect definitional scope and reporting incentives, not more alien evidence. A wider legal net catches more stuff, including plenty of ordinary or data-poor events, and that alone can fuel UFO news and non-human intelligence speculation without adding a single confirmed extraterrestrial fact.

Whistleblower Protections and Reporting Channels

Broadening the funnel answers what can be counted. The next question is how potentially sensitive information moves from people on the inside to oversight without forcing them into a public, career-ending gamble.

Whistleblower language matters because it changes the risk math for insiders. If you’re sitting on information that oversight bodies actually need, the difference between “go public” and “use a protected pathway” is the difference between career-ending exposure and a process that can move the facts to inspectors general and Congress without turning you into the headline.

A “protected disclosure” is a report made through an authorized channel that the law treats as legitimate whistleblowing, which triggers anti-retaliation rules. The baseline backbone here is the Whistleblower Protection Act, which bars retaliation against federal employees and applicants for making qualifying disclosures (5 U.S.C. § 2302(b)(8)). In plain terms: if you disclose the right kind of concern, to the right place, your agency can’t legally punish you for the act of reporting.

On the UAP side, the FY2023 NDAA includes provisions that explicitly channel UAP-related reporting and briefings into established oversight routes and refers to secure reporting to Inspectors General and to congressional oversight committees; those authorities are reflected in the codified AARO statute at 50 U.S.C. § 3373 and in the enacted FY2023 text (see Pub. L. 117-263, https://www.govinfo.gov/content/pkg/PLAW-117publ263/pdf/PLAW-117publ263.pdf and 50 U.S.C. § 3373, https://www.law.cornell.edu/uscode/text/50/3373). The net effect is practical: AARO-era reporting is being pulled more explicitly into an ecosystem where oversight knows how to receive, triage, and investigate disclosures without requiring public airing first.

This fits the broader pattern of FY2023-era intelligence legislation: the Congressional Research Service and other analyses note whistleblower-related and oversight-focused provisions in that legislative package; see CRS and legislative summaries linked from Congress.gov and the enacted law (Pub. L. 117-263, https://www.govinfo.gov/content/pkg/PLAW-117publ263/pdf/PLAW-117publ263.pdf).

Here’s the friction most people miss: whistleblower pathways don’t equal auto-declassification. If the information is classified information (meaning it’s been designated for national security protection), “telling the truth” still has to happen inside secure, authorized channels. That usually means reporting to an Inspector General, certain congressional committees, or other authorized recipients, using secure facilities and procedures, not a podcast, not social media, and not a public document dump.

That constraint is why a lot of insider reporting sounds vague in public even when it’s specific in closed settings. And it’s also why fear of reprisal often centers on clearance status: community discussion around UAP whistleblowing regularly points to worries about losing security clearances. Whether or not any particular case is credible, the incentive structure is real: if your job requires access, even a perceived compliance mistake can feel existential.

If you want a simple mental model, think “two tracks.” One track is oversight: detailed facts can be provided securely to people who are cleared and authorized. The other track is public: what can be said is limited by what has been declassified, regardless of how sincere the whistleblower is.

These protections can’t force the government to publish the underlying evidence. They can’t compel instant answers, instant hearings, or instant confirmation. They also don’t prove a claim just because the report was made through a protected channel. A protected disclosure is about process and retaliation risk, not automatic validation.

They also can’t erase the legal consequences of mishandling secrets. If someone walks classified material into the public domain, they’re no longer just “whistleblowing”; they’re potentially committing an unauthorized disclosure. (This is the common-sense reason statutes like 18 U.S.C. § 798 exist: classified national security information is legally protected, and mishandling it has consequences.)

This is where high-profile narratives people associate with names like David Grusch intersect with the law: clearer channels and clearer protections can increase the odds that credible reporting reaches oversight in a form oversight can actually use, without requiring the whistleblower to publicly litigate classified details. That intersection explains the surge in attention without confirming any specific allegation as fact.

Takeaway for reading future “whistleblower” headlines: ask three questions. (1) Was it a protected disclosure, or just a public claim? (2) Who received it, and through what channel (IG, Congress, other authorized route)? (3) What can legally be said publicly given classification rules? Those answers usually explain why a story feels dramatic in public while the real action, if any, happens behind closed doors.

Congressional Oversight and Transparency Push

Secure reporting channels only matter if someone on the receiving end is positioned to demand follow-up. That’s where oversight becomes the real engine: it turns one-off reports into recurring obligations that have to be answered.

Oversight is the real engine. UAP headlines come and go, but what actually forces sustained movement is Congress turning curiosity into recurring obligations: routine briefings, written deliverables, deadlines, and consequences for noncompliance. When anything gets more transparent inside government, it’s usually because lawmakers demand a steady flow of updates they can measure against last quarter’s promises.

FY2023 operationalizes oversight by hardwiring a cadence: expanded congressional briefings on UAP and a shift from an annual reporting mindset to quarterly congressional briefings, meaning scheduled updates every three months that create a predictable accountability cycle. The statutory basis for this reporting cadence appears in the codified AARO provisions at 50 U.S.C. § 3373, which directs the Director of the All-domain Anomaly Resolution Office to provide regular briefings and reports to congressional oversight committees, including the congressional intelligence committees and the Committees on Armed Services of the Senate and House (see 50 U.S.C. § 3373, https://www.law.cornell.edu/uscode/text/50/3373 and Pub. L. 117-263, https://www.govinfo.gov/content/pkg/PLAW-117publ263/pdf/PLAW-117publ263.pdf).

That rhythm changes behavior because it removes the escape hatch of waiting a year for the next check-in. If an office misses a deliverable, drifts off scope, or can’t answer basic resourcing questions, there’s another deadline coming fast and another room of staffers ready to ask why.

Congress has strong levers, but they’re mostly internal-facing. Lawmakers can compel briefings, mandate reports, set due dates, and use funding pressure to reward cooperation or punish foot-dragging. They can also require that specific topics get addressed, like readiness impacts or program costs, which forces agencies to do the bookkeeping even if they’d rather not.

What Congress can’t do instantly is convert classified specifics into public receipts. A quarterly briefing can be detailed and still stay behind closed doors. Classification rules, compartmented programs, ongoing investigations, and sensitive sources and methods don’t evaporate because a statute says “report.” Oversight can increase accountability without guaranteeing public disclosure, and that’s the friction most online “disclosure is here” claims ignore.

Later efforts often get blended into “what FY2023 did,” but they are separate. Senator Chuck Schumer filed the “UAP Disclosure Act of 2023” as a proposed amendment to an NDAA vehicle. That’s later than the FY2023 NDAA and it’s proposed language, not the same thing as enacted FY2023 oversight requirements.

The practical move: treat “enacted” as one bucket (binding obligations right now) and “proposed” as another (a signal of intent that still has to survive procedure).

Skip screenshots and viral summaries. Congress.gov hosts pages for amendments that show the text and a plain-status timeline of what happened to it. Senate Amendment 4296 is a clean example of the format: you can see the amendment language and the procedural status markers in one place, which makes it easy to separate “filed” from “adopted” from “dropped” (see Congress.gov, S.Amdt. 4296, https://www.congress.gov/amendment/117th-congress/senate-amendment/4296).

1. Confirm status: Is it enacted law, or a proposed bill/amendment?
2. Identify the deliverable: Briefing, written report, database, notification, or declassification action?
3. Check the audience: Congress in closed session, specific oversight panels, or the public?
4. Verify cadence: One-time, annual, or quarterly congressional briefings with a repeating deadline?
5. Look for teeth: Deadlines, required topics (like costs/readiness), and any link to funding or compliance.

What Changes for the Public Next

All of that process can feel abstract until you look at what it produces on the outside: new intake mechanisms, predictable reporting cycles, and bursts of coverage tied to official drop dates rather than random viral clips.

The biggest change you’ll notice isn’t a single “bombshell” moment. It’s a steadier, more bureaucratic pattern: more formal ways to report UAP (unidentified anomalous phenomena), more recurring official updates, and more predictable spikes in UAP news when those updates drop.

First, expect more standardized intake signals, not just leaks and anecdotes. The reporting-mechanism directive most directly appears in the FY2022 NDAA, not FY2023: Pub. L. 117-81, div. A, title XVI, section 1683 required the establishment of an Anomaly Surveillance and Resolution Office and directed the Secretary of Defense to develop procedures and a standardized reporting mechanism to collect and analyze reports (see Pub. L. 117-81, https://www.govinfo.gov/content/pkg/PLAW-117publ81/pdf/PLAW-117publ81.pdf). That earlier statutory step is what turned “tell someone” into “submit through a defined channel” and set the template that the FY2023 codification later built on.

AARO has also been explicit about the public-facing side: AARO’s website states it will announce when a reporting mechanism is available to the public. Practically, that means you should expect “new portal/process available” style announcements, followed by a wave of stories that treat the mechanism itself as news.

On the reporting cadence, ODNI has submitted a classified consolidated annual report to Congress and published an unclassified version publicly. ODNI and other agencies have posted unclassified UAP products in the past, and those public summaries are the pattern: regular public summaries, with the details Congress gets remaining behind closed doors (see ODNI UAP content and reports, https://www.dni.gov/index.php/newsroom/reports-publications and the ODNI reports collection, https://www.dni.gov/index.php/newsroom/reports-publications/reports-publications-2023).

Better pipelines don’t equal full transparency. You still shouldn’t expect raw sensor data dumps, granular source-and-methods details, or immediate official confirmation of whatever is trending on social media. Classification and protection of capabilities mean the public version will stay high-level even when the government has sharper internal resolution.

Use one simple rule: “unresolved” isn’t “alien,” and it also isn’t “debunked.” It usually means the case lacks enough quality data to attribute confidently, or the best data can’t be released publicly. Likewise, “under investigation” often signals process, not imminent revelation.

Also watch the calendar. Hearings, briefings, and report releases create predictable media cycles, which is why “UFO sightings 2025” and “UFO sightings 2026” search spikes tend to track official drop dates and new reporting mechanisms, not sudden new physics.

And when you see “government cover-up” framing, sanity-check it against the mundane explanation first: classification boundaries and slow-moving bureaucracy can produce silence that looks sinister from the outside.

1. Check AARO’s official site for the public reporting mechanism announcement.
2. Download ODNI’s unclassified UAP report when it posts, and read the scope and time window.
3. Separate “unresolved” from “confirmed” in your own notes before you share a headline.
4. Track spikes around hearings and report releases so you don’t confuse cadence with “new proof.”

The NDAA’s Real Disclosure Impact

If the earlier sections felt like plumbing, that’s because they are and that’s the point. The FY2023 NDAA didn’t promise a cinematic reveal; it changed the parts of the system that decide what gets counted, how it gets reported, and how often Congress can demand updates.

If you came here hoping the FY2023 NDAA quietly flipped a switch and forced instant “UFO disclosure,” the real story is less cinematic and more useful: it changed the structure. It strengthened the office mandate, widened what gets pulled into the system, and made it safer for insiders to talk through official channels, while still leaving public visibility constrained. As an authorization framework focused on what government components must do and fund, the provided excerpts don’t show an explicit mandate for automatic public release of classified materials.

Three enacted-policy shifts drive that reality. First, AARO’s scope expands: more responsibilities, more briefing expectations, and concrete deliverables, including the historical record report milestone commonly referenced as Volume II (see Pub. L. 117-263, which directs a historical-record compilation and associated reporting requirements; Pub. L. 117-263, https://www.govinfo.gov/content/pkg/PLAW-117publ263/pdf/PLAW-117publ263.pdf). Second, the broadened UAP definition widens the funnel, so more types of observations and incidents qualify for tracking and review. Third, whistleblower pathways get clearer and stronger in law and policy: you can report through protected channels, but what the public sees is still bounded by classification (the protection is about reporting safely, not auto-publishing).

To be specific about the “Volume II” reference: the enacted NDAA language calls for a historical-record compilation to be prepared as part of the statutory reporting workstream; that product has been described in public briefings and implementation documents as “Volume II” of the historical record. The statutory text contemplates that material compiled for congressional oversight may include classified content while permitting an unclassified summary or public-facing version to the extent possible; see Pub. L. 117-263 and the codified AARO provisions at 50 U.S.C. § 3373 for the reporting framework and expectations (https://www.govinfo.gov/content/pkg/PLAW-117publ263/pdf/PLAW-117publ263.pdf and https://www.law.cornell.edu/uscode/text/50/3373). When Volume II is delivered, agencies typically note whether the product or any part of it will be released publicly in unclassified form or held as classified material with an unclassified executive summary.

For 2025 to 2026, skip the hype and watch the process signals that reliably generate real movement and predictable headlines: (1) the Section 6802 Volume II milestone you can verify when it lands, (2) recurring briefings that drive periodic bursts of public chatter without necessarily adding new public facts, and (3) ODNI/AARO public-facing report drops, which tend to trigger “UFO sightings 2025/2026” spikes in coverage. If you want clean, source-tied breakdowns as those milestones hit, subscribe for updates or check back for the next report recap.

Frequently Asked Questions