S.Amdt. 2624

1. Strikes title VII

   Strikes

   In S. 3414 · Placed on Calendar Senate

   Struck: TITLE VII--INFORMATION SHARING

   Struck: SEC. 701. AFFIRMATIVE AUTHORITY TO MONITOR AND DEFEND AGAINST CYBERSECURITY THREATS.

   Struck: (a) In General.--Notwithstanding chapter 119, 121, or 206 of title 18, United States Code, the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.), and sections 222 and 705 of the Communications Act of 1934 (47 U.S.C. 222 and 605), any private entity may--

   Struck: (1) monitor its information systems and information that is stored on, processed by, or transiting such information systems for--

   Show 250 more struck paragraphsShow less

   Struck: (A) malicious reconnaissance;

   Struck: (B) efforts to defeat a technical control or an operational control;

   Struck: (C) technical vulnerabilities;

   Struck: (D) efforts to cause a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a technical control or an operational control;

   Struck: (E) malicious cyber command and control;

   Struck: (F) information exfiltrated as a result of defeating a technical control or an operational control;

   Struck: (G) any other attribute of a cybersecurity threat, if monitoring for such attribute is not otherwise prohibited by law; or

   Struck: (H) any combination of subparagraphs (A) through (G);

   Struck: (2) operate countermeasures on its information systems to protect its rights or property from cybersecurity threats;

   Struck: (3) consent to another private entity monitoring or operating countermeasures on its information systems and information that is stored on, processed by, or transiting such information systems in accordance with this section;

   Struck: (4) monitor a third party's information systems and information that is stored on, processed by, or transiting such information systems for the information listed in subparagraphs (A) through (H) of paragraph (1), if--

   Struck: (A) the third party provides express prior consent to such monitoring; and

   Struck: (B) such monitoring would be lawful under paragraph (1) or under any other provision of law if the third party were to perform such monitoring of its own networks; and

   Struck: (5) operate countermeasures on a third party's information systems to protect the third party's rights or property from cybersecurity threats, if--

   Struck: (A) the third party provides express prior consent to such countermeasures; and

   Struck: (B) operating such countermeasures would be lawful under paragraph (2) or under any other provision of law if the third party were to operate such countermeasures on its own information systems to protect its own rights or property.

   Struck: (b) Use and Protection of Information.--A private entity performing monitoring or operating countermeasures under subsection (a)--

   Struck: (1) may use cybersecurity threat indicators acquired under this title, provided such use is solely for the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from cybersecurity threats or mitigating such threats;

   Struck: (2) shall make reasonable efforts to safeguard communications, records, system traffic, or other information that may be used to identify specific persons acquired in the course of such monitoring from unauthorized access or acquisition;

   Struck: (3) shall comply with any lawful restrictions placed on the use of cybersecurity threat indicators, including, if requested, the removal or destruction of information that can be used to identify specific persons from such indicators;

   Struck: (4) may not use cybersecurity threat indicators to gain an unfair competitive advantage to the detriment of the entity that authorized such monitoring or operation of countermeasures; and

   Struck: (5) may use information obtained under any other provision of law.

   Struck: SEC. 702. VOLUNTARY DISCLOSURE OF CYBERSECURITY THREAT INDICATORS AMONG PRIVATE ENTITIES.

   Struck: (a) Authority to Disclose.--Notwithstanding any other provision of law, any private entity may disclose lawfully obtained cybersecurity threat indicators to any other private entity in accordance with this section.

   Struck: (b) Use and Protection of Information.--A private entity disclosing or receiving cybersecurity threat indicators pursuant to subsection (a)--

   Struck: (1) may use, retain, or further disclose such cybersecurity threat indicators solely for the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from cybersecurity threats or mitigating such threats;

   Struck: (2) shall make reasonable efforts to safeguard communications, records, system traffic, or other information that can be used to identify specific persons from unauthorized access or acquisition;

   Struck: (3) shall comply with any lawful restrictions placed on the disclosure or use of cybersecurity threat indicators, including, if requested, the removal of information that may be used to identify specific persons from such indicators; and

   Struck: (4) may not use the cybersecurity threat indicators to gain an unfair competitive advantage to the detriment of the entity that authorized such sharing.

   Struck: (c) Transfers to Unreliable Private Entities Prohibited.--A private entity may not disclose cybersecurity threat indicators to another private entity that the disclosing entity knows--

   Struck: (1) has intentionally or willfully violated the requirements of subsection (b); and

   Struck: (2) is reasonably likely to violate such requirements.

   Struck: SEC. 703. CYBERSECURITY EXCHANGES.

   Struck: (a) Designation of Cybersecurity Exchanges.--The Secretary of Homeland Security, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall establish--

   Struck: (1) a process for designating one or more appropriate civilian Federal entities or non-Federal entities to serve as cybersecurity exchanges to receive and distribute cybersecurity threat indicators;

   Struck: (2) procedures to facilitate and ensure the sharing of classified and unclassified cybersecurity threat indicators in as close to real time as possible with appropriate Federal entities and non-Federal entities in accordance with this title; and

   Struck: (3) a process for identifying certified entities to receive classified cybersecurity threat indicators in accordance with paragraph (2).

   Struck: (b) Purpose.--The purpose of a cybersecurity exchange is to receive and distribute, in as close to real time as possible, cybersecurity threat indicators, and to thereby avoid unnecessary and duplicative Federal bureaucracy for information sharing as provided in this title.

   Struck: (c) Requirement for a Lead Federal Civilian Cybersecurity Exchange.--

   Struck: (1) In general.--The Secretary, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall designate a civilian Federal entity as the lead cybersecurity exchange to serve as a focal point within the Federal Government for cybersecurity information sharing among Federal entities and with non-Federal entities.

   Struck: (2) Responsibilities.--The lead Federal civilian cybersecurity exchange designated under paragraph (1) shall--

   Struck: (A) receive and distribute, in as close to real time as possible, cybersecurity threat indicators in accordance with this title;

   Struck: (B) facilitate information sharing, interaction, and collaboration among and between--

   Struck: (i) Federal entities;

   Struck: (ii) State, local, tribal, and territorial governments;

   Struck: (iii) private entities;

   Struck: (iv) academia;

   Struck: (v) international partners, in consultation with the Secretary of State; and

   Struck: (vi) other cybersecurity exchanges;

   Struck: (C) disseminate timely and actionable cybersecurity threat, vulnerability, mitigation, and warning information lawfully obtained from any source, including alerts, advisories, indicators, signatures, and mitigation and response measures, to appropriate Federal and non-Federal entities in as close to real time as possible, to improve the security and protection of information systems;

   Struck: (D) coordinate with other Federal and non-Federal entities, as appropriate, to integrate information from Federal and non-Federal entities, including Federal cybersecurity centers, non-Federal network or security operation centers, other cybersecurity exchanges, and non-Federal entities that disclose cybersecurity threat indicators under section 704(a), in as close to real time as possible, to provide situational awareness of the United States information security posture and foster information security collaboration among information system owners and operators;

   Struck: (E) conduct, in consultation with private entities and relevant Federal and other governmental entities, regular assessments of existing and proposed information sharing models to eliminate bureaucratic obstacles to information sharing and identify best practices for such sharing; and

   Struck: (F) coordinate with other Federal entities, as appropriate, to compile and analyze information about risks and incidents that threaten information systems, including information voluntarily submitted in accordance with section 704(a) or otherwise in accordance with applicable laws.

   Struck: (3) Schedule for designation.--The designation of a lead Federal civilian cybersecurity exchange under paragraph (1) shall be made concurrently with the issuance of the interim policies and procedures under section 704(g)(3)(D).

   Struck: (d) Additional Civilian Federal Cybersecurity Exchanges.--In accordance with the process and procedures established in subsection (a), the Secretary, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, may designate additional civilian Federal entities to receive and distribute cybersecurity threat indicators, if such entities are subject to the requirements for use, retention, and disclosure of information by a cybersecurity exchange under section 704(b) and the special requirements for Federal entities under section 704(g).

   Struck: (e) Requirements for Non-Federal Cybersecurity Exchanges.--

   Struck: (1) In general.--In considering whether to designate a private entity or any other non-Federal entity as a cybersecurity exchange to receive and distribute cybersecurity threat indicators under section 704, and what entity to designate, the Secretary shall consider the following factors:

   Struck: (A) The net effect that such designation would have on the overall cybersecurity of the United States.

   Struck: (B) Whether such designation could substantially improve such overall cybersecurity by serving as a hub for receiving and sharing cybersecurity threat indicators in as close to real time as possible, including the capacity of the non-Federal entity for performing those functions.

   Struck: (C) The capacity of such non-Federal entity to safeguard cybersecurity threat indicators from unauthorized disclosure and use.

   Struck: (D) The adequacy of the policies and procedures of such non-Federal entity to protect personally identifiable information from unauthorized disclosure and use.

   Struck: (E) The ability of the non-Federal entity to sustain operations using entirely non-Federal sources of funding.

   Struck: (2) Regulations.--The Secretary may promulgate regulations as may be necessary to carry out this subsection.

   Struck: (f) Construction With Other Authorities.--Nothing in this section may be construed to alter the authorities of a Federal cybersecurity center, unless such cybersecurity center is acting in its capacity as a designated cybersecurity exchange.

   Struck: (g) Congressional Notification of Designation of Cybersecurity Exchanges.--

   Struck: (1) In general.--The Secretary, in coordination with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall promptly notify Congress, in writing, of any designation of a cybersecurity exchange under this title.

   Struck: (2) Requirement.--Written notification under paragraph (1) shall include a description of the criteria and processes used to make the designation.

   Struck: SEC. 704. VOLUNTARY DISCLOSURE OF CYBERSECURITY THREAT INDICATORS TO A CYBERSECURITY EXCHANGE.

   Struck: (a) Authority to Disclose.--Notwithstanding any other provision of law, a non-Federal entity may disclose lawfully obtained cybersecurity threat indicators to a cybersecurity exchange in accordance with this section.

   Struck: (b) Use, Retention, and Disclosure of Information by a Cybersecurity Exchange.--A cybersecurity exchange may only use, retain, or further disclose information provided pursuant to subsection (a)--

   Struck: (1) in order to protect information systems from cybersecurity threats and to mitigate cybersecurity threats; or

   Struck: (2) to law enforcement pursuant to subsection (g)(2).

   Struck: (c) Use and Protection of Information Received From a Cybersecurity Exchange.--A non-Federal entity receiving cybersecurity threat indicators from a cybersecurity exchange--

   Struck: (1) may use, retain, or further disclose such cybersecurity threat indicators solely for the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from cybersecurity threats or mitigating such threats;

   Struck: (2) shall make reasonable efforts to safeguard communications, records, system traffic, or other information that can be used to identify specific persons from unauthorized access or acquisition;

   Struck: (3) shall comply with any lawful restrictions placed on the disclosure or use of cybersecurity threat indicators by the cybersecurity exchange or a third party, if the cybersecurity exchange received such information from the third party, including, if requested, the removal of information that can be used to identify specific persons from such indicators; and

   Struck: (4) may not use the cybersecurity threat indicators to gain an unfair competitive advantage to the detriment of the third party that authorized such sharing.

   Struck: (d) Exemption From Public Disclosure.--Any cybersecurity threat indicator disclosed by a non-Federal entity to a cybersecurity exchange pursuant to subsection (a) shall be--

   Struck: (1) exempt from disclosure under section 552(b)(3) of title 5, United States Code, or any comparable State law; and

   Struck: (2) treated as voluntarily shared information under section 552 of title 5, United States Code, or any comparable State law.

   Struck: (e) Exemption From Ex Parte Limitations.--Any cybersecurity threat indicator disclosed by a non-Federal entity to a cybersecurity exchange pursuant to subsection (a) shall not be subject to the rules of any governmental entity or judicial doctrine regarding ex parte communications with a decision making official.

   Struck: (f) Exemption From Waiver of Privilege.--Any cybersecurity threat indicator disclosed by a non-Federal entity to a cybersecurity exchange pursuant to subsection (a) may not be construed to be a waiver of any applicable privilege or protection provided under Federal, State, tribal, or territorial law, including any trade secret protection.

   Struck: (g) Special Requirements for Federal and Law Enforcement Entities.--

   Struck: (1) Receipt, disclosure and use of cybersecurity threat indicators by a federal entity.--

   Struck: (A) Authority to receive and use cybersecurity threat indicators.--A Federal entity that is not a cybersecurity exchange may receive, retain, and use cybersecurity threat indicators from a cybersecurity exchange in order--

   Struck: (i) to protect information systems from cybersecurity threats and to mitigate cybersecurity threats; and

   Struck: (ii) to disclose such cybersecurity threat indicators to law enforcement in accordance with paragraph (2).

   Struck: (B) Authority to disclose cybersecurity threat indicators.--A Federal entity that is not a cybersecurity exchange shall ensure that if disclosing cybersecurity threat indicators to a non-Federal entity under this section, such non-Federal entity shall use or retain such cybersecurity threat indicators in a manner that is consistent with the requirements in--

   Struck: (i) subsection (b) on the use and protection of information; and

   Struck: (ii) paragraph (2).

   Struck: (2) Law enforcement access and use of cybersecurity threat indicators.--

   Struck: (A) Disclosure to law enforcement.--A Federal entity may disclose cybersecurity threat indicators received under this title to a law enforcement entity if--

   Struck: (i) the disclosure is permitted under the procedures developed by the Secretary and approved by the Attorney General under paragraph (3); and

   Struck: (ii) the information appears to pertain--

   Struck: (I) to a cybersecurity crime which has been, is being, or is about to be committed;

   Struck: (II) to an imminent threat of death or serious bodily harm; or

   Struck: (III) to a serious threat to minors, including sexual exploitation and threats to physical safety.

   Struck: (B) Use by law enforcement.--A law enforcement entity may only use cybersecurity threat indicators received by a Federal entity under paragraph (A) in order--

   Struck: (i) to protect information systems from a cybersecurity threat or investigate, prosecute, or disrupt a cybersecurity crime;

   Struck: (ii) to protect individuals from an imminent threat of death or serious bodily harm; or

   Struck: (iii) to protect minors from any serious threat, including sexual exploitation and threats to physical safety.

   Struck: (3) Privacy and civil liberties.--

   Struck: (A) Requirement for policies and procedures.--The Secretary, in consultation with privacy and civil liberties experts, the Director of National Intelligence, and the Secretary of Defense, shall develop and periodically review policies and procedures governing the receipt, retention, use, and disclosure of cybersecurity threat indicators by a Federal entity obtained in connection with activities authorized in this title. Such policies and procedures shall--

   Struck: (i) minimize the impact on privacy and civil liberties, consistent with the need to protect information systems from cybersecurity threats and mitigate cybersecurity threats;

   Struck: (ii) reasonably limit the receipt, retention, use and disclosure of cybersecurity threat indicators associated with specific persons consistent with the need to carry out the responsibilities of this title, including establishing a process for the timely destruction of cybersecurity threat indicators that are received pursuant to this section that do not reasonably appear to be related to the purposes identified in paragraph (1)(A);

   Struck: (iii) include requirements to safeguard cybersecurity threat indicators that may be used to identify specific persons from unauthorized access or acquisition;

   Struck: (iv) include procedures for notifying entities, as appropriate, if information received pursuant to this section is not a cybersecurity threat indicator; and

   Struck: (v) protect the confidentiality of cybersecurity threat indicators associated with specific persons to the greatest extent practicable and require recipients to be informed that such indicators may only be used for the purposes identified in paragraph (1)(A).

   Struck: (B) Adoption of policies and procedures.--The head of an agency responsible for a Federal entity designated as a cybersecurity exchange under section 703 shall adopt and comply with the policies and procedures developed under this paragraph.

   Struck: (C) Review by the attorney general.--The policies and procedures developed under this subsection shall be provided to the Attorney General for review not later than 1 year after the date of the enactment of this title, and shall not be issued without the Attorney General's approval.

   Struck: (D) Requirement for interim policies and procedures.--The Secretary shall issue interim policies and procedures not later than 60 days after the date of the enactment of this title.

   Struck: (E) Provision to congress.--The policies and procedures issued under this title and any amendments to such policies and procedures shall be provided to Congress in an unclassified form and be made public, but may include a classified annex.

   Struck: (4) Oversight.--

   Struck: (A) Requirement for oversight.--The Secretary and the Attorney General shall establish a mandatory program to monitor and oversee compliance with the policies and procedures issued under this subsection.

   Struck: (B) Notification of the attorney general.--The head of each Federal entity that receives information under this title shall--

   Struck: (i) comply with the policies and procedures developed by the Secretary and approved by the Attorney General under paragraph (3);

   Struck: (ii) promptly notify the Attorney General of significant violations of such policies and procedures; and

   Struck: (iii) provide to the Attorney General any information relevant to the violation that the Attorney General requires.

   Struck: (C) Annual report.--On an annual basis, the Chief Privacy and Civil Liberties Officer of the Department of Justice and the Chief Privacy Officer of the Department, in consultation with the most senior privacy and civil liberties officer or officers of any appropriate agencies, shall jointly submit to Congress a report assessing the privacy and civil liberties impact of the governmental activities conducted pursuant to this title.

   Struck: (5) Reports on information sharing.--

   Struck: (A) Privacy and civil liberties oversight board report.--Not later than 2 years after the date of the enactment of this title, and every 2 years thereafter, the Privacy and Civil Liberties Oversight Board shall submit to Congress and the President a report providing--

   Struck: (i) an analysis of the practices of private entities that are performing, monitoring, operating countermeasures, or disclosing cybersecurity threat indicators pursuant to this title;

   Struck: (ii) an assessment of the privacy and civil liberties impact of the activities carried out by the Federal entities under this title; and

   Struck: (iii) recommendations for improvements to or modifications of the law and the policies and procedures established pursuant to paragraph (3) in order to address privacy and civil liberties concerns.

   Struck: (B) Inspectors general annual report.--The Inspector General of the Department, the Inspector General of the Intelligence Community, the Inspector General of the Department of Justice, and the Inspector General of the Department of Defense shall, on an annual basis, jointly submit to Congress a report on the receipt, use and disclosure of information shared with a Federal cybersecurity exchange under this title, including--

   Struck: (i) a review of the use by Federal entities of such information for a purpose other than to protect information systems from cybersecurity threats and to mitigate cybersecurity threats, including law enforcement access and use pursuant to paragraph (2);

   Struck: (ii) a review of the type of information shared with a Federal cybersecurity exchange;

   Struck: (iii) a review of the actions taken by Federal entities based on such information;

   Struck: (iv) appropriate metrics to determine the impact of the sharing of such information with a Federal cybersecurity exchange on privacy and civil liberties;

   Struck: (v) a list of Federal entities receiving such information;

   Struck: (vi) a review of the sharing of such information among Federal entities to identify inappropriate stovepiping of shared information; and

   Struck: (vii) any recommendations of the inspectors general for improvements or modifications to the authorities under this title.

   Struck: (C) Form.--Each report required under this paragraph shall be submitted in unclassified form, but may include a classified annex.

   Struck: (6) Sanctions.--The head of each Federal entity that conducts activities under this title shall develop and enforce appropriate sanctions for officers, employees, or agents of such entities who conducts such activities--

   Struck: (A) outside the normal course of their specified duties;

   Struck: (B) in a manner inconsistent with the discharge of the responsibilities of such entity; or

   Struck: (C) in contravention of the requirements, policies, and procedures required by this subsection.

   Struck: (7) Federal government liability for violations of this title.--

   Struck: (A) In general.--If a Federal entity intentionally or willfully violates a provision of this title or a regulation promulgated under this title, the United States shall be liable to a person adversely affected by such violation in an amount equal to the sum of--

   Struck: (i) the actual damages sustained by the person as a result of the violation or $1,000, whichever is greater; and

   Struck: (ii) the costs of the action together with reasonable attorney fees as determined by the court.

   Struck: (B) Venue.--An action to enforce liability created under this subsection may be brought in the district court of the United States in--

   Struck: (i) the district in which the complainant resides;

   Struck: (ii) the district in which the principal place of business of the complainant is located;

   Struck: (iii) the district in which the Federal entity that disclosed the information is located; or

   Struck: (iv) the District of Columbia.

   Struck: (C) Statute of limitations.--No action shall lie under this subsection unless such action is commenced not later than 2 years after the date of the violation that is the basis for the action.

   Struck: (D) Exclusive cause of action.--A cause of action under this subsection shall be the exclusive means available to a complainant seeking a remedy for a disclosure of information in violation of this title by a Federal entity.

   Struck: SEC. 705. SHARING OF CLASSIFIED CYBERSECURITY THREAT INDICATORS.

   Struck: (a) Sharing of Classified Cybersecurity Threat Indicators.--The procedures established under section 703(a)(2) shall provide that classified cybersecurity threat indicators may only be--

   Struck: (1) shared with certified entities;

   Struck: (2) shared in a manner that is consistent with the need to protect the national security of the United States;

   Struck: (3) shared with a person with an appropriate security clearance to receive such cybersecurity threat indicators; and

   Struck: (4) used by a certified entity in a manner that protects such cybersecurity threat indicators from unauthorized disclosure.

   Struck: (b) Requirement for Guidelines.--Not later than 60 days after the date of the enactment of this title, the Director of National Intelligence shall issue guidelines providing that appropriate Federal officials may, as the Director considers necessary to carry out this title--

   Struck: (1) grant a security clearance on a temporary or permanent basis to an employee of a certified entity;

   Struck: (2) grant a security clearance on a temporary or permanent basis to a certified entity and approval to use appropriate facilities; or

   Struck: (3) expedite the security clearance process for such an employee or entity, if appropriate, in a manner consistent with the need to protect the national security of the United States.

   Struck: (c) Distribution of Procedures and Guidelines.--Following the establishment of the procedures under section 703(a)(2) and the issuance of the guidelines under subsection (b), the Secretary and the Director of National Intelligence shall expeditiously distribute such procedures and guidelines to--

   Struck: (1) appropriate governmental entities and private entities;

   Struck: (2) the Committee on Armed Services, the Committee on Commerce, Science, and Transportation, the Committee on Homeland Security and Governmental Affairs, the Committee on the Judiciary, and the Select Committee on Intelligence of the Senate; and

   Struck: (3) the Committee on Armed Services, the Committee on Energy and Commerce, the Committee on Homeland Security, the Committee on the Judiciary, and the Permanent Select Committee on Intelligence of the House of Representatives.

   Struck: SEC. 706. LIMITATION ON LIABILITY AND GOOD FAITH DEFENSE FOR CYBERSECURITY ACTIVITIES.

   Struck: (a) In General.--No civil or criminal cause of action shall lie or be maintained in any Federal or State court against any entity acting as authorized by this title, and any such action shall be dismissed promptly for activities authorized by this title consisting of--

   Struck: (1) the cybersecurity monitoring activities authorized by paragraph (1), (3) or (4) of section 701(a); or

   Struck: (2) the voluntary disclosure of a lawfully obtained cybersecurity threat indicator--

   Struck: (A) to a cybersecurity exchange pursuant to section 704(a);

   Struck: (B) by a provider of cybersecurity services to a customer of that provider;

   Struck: (C) to a private entity or governmental entity that provides or manages critical infrastructure (as that term is used in section 1016 of the Critical Infrastructures Protection Act of 2001 (42 U.S.C. 5195c)); or

   Struck: (D) to any other private entity under section 702(a), if the cybersecurity threat indicator is also disclosed within a reasonable time to a cybersecurity exchange.

   Struck: (b) Good Faith Defense.--If a civil or criminal cause of action is not barred under subsection (a), a reasonable good faith reliance that this title permitted the conduct complained of is a complete defense against any civil or criminal action brought under this title or any other law.

   Struck: (c) Limitation on Use of Cybersecurity Threat Indicators for Regulatory Enforcement Actions.--No Federal entity may use a cybersecurity threat indicator received pursuant to this title as evidence in a regulatory enforcement action against the entity that lawfully shared the cybersecurity threat indicator with a cybersecurity exchange that is a Federal entity.

   Struck: (d) Delay of Notification Authorized for Law Enforcement, National Security, or Homeland Security Purposes.--No civil or criminal cause of action shall lie or be maintained in any Federal or State court against any entity, and any such action shall be dismissed promptly, for a failure to disclose a cybersecurity threat indicator if--

   Struck: (1) the Attorney General or the Secretary determines that disclosure of a cybersecurity threat indicator would impede a civil or criminal investigation and submits a written request to delay notification for up to 30 days, except that the Attorney General or the Secretary may, by a subsequent written request, revoke such delay or extend the period of time set forth in the original request made under this paragraph if further delay is necessary; or

   Struck: (2) the Secretary, the Attorney General, or the Director of National Intelligence determines that disclosure of a cybersecurity threat indicator would threaten national or homeland security and submits a written request to delay notification, except that the Secretary, the Attorney General, or the Director, may, by a subsequent written request, revoke such delay or extend the period of time set forth in the original request made under this paragraph if further delay is necessary.

   Struck: (e) Limitation on Liability for Failure to Act.--No civil or criminal cause of action shall lie or be maintained in any Federal or State court against any private entity, or any officer, employee, or agent of such an entity, and any such action shall be dismissed promptly, for the reasonable failure to act on information received under this title.

   Struck: (f) Defense for Breach of Contract.--Compliance with lawful restrictions placed on the disclosure or use of cybersecurity threat indicators is a complete defense to any tort or breach of contract claim originating in a failure to disclose cybersecurity threat indicators to a third party.

   Struck: (g) Limitation on Liability Protections.--Any person who, knowingly or acting in gross negligence, violates a provision of this title or a regulation promulgated under this title shall--

   Struck: (1) not receive the protections of this title; and

   Struck: (2) be subject to any criminal or civil cause of action that may arise under any other State or Federal law prohibiting the conduct in question.

   Struck: SEC. 707. CONSTRUCTION AND FEDERAL PREEMPTION.

   Struck: (a) Construction.--Nothing in this title may be construed--

   Struck: (1) to limit any other existing authority or lawful requirement to monitor information systems and information that is stored on, processed by, or transiting such information systems, operate countermeasures, and retain, use or disclose lawfully obtained information;

   Struck: (2) to permit the unauthorized disclosure of--

   Struck: (A) information that has been determined by the Federal Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations;

   Struck: (B) any restricted data (as that term is defined in paragraph (y) of section 11 of the Atomic Energy Act of 1954 (42 U.S.C. 2014));

   Struck: (C) information related to intelligence sources and methods; or

   Struck: (D) information that is specifically subject to a court order or a certification, directive, or other authorization by the Attorney General precluding such disclosure;

   Struck: (3) to provide additional authority to, or modify an existing authority of, the Department of Defense or the National Security Agency or any other element of the intelligence community to control, modify, require, or otherwise direct the cybersecurity efforts of a non-Federal entity or a Federal entity;

   Struck: (4) to limit or modify an existing information sharing relationship;

   Struck: (5) to prohibit a new information sharing relationship;

   Struck: (6) to require a new information sharing relationship between a Federal entity and a private entity;

   Struck: (7) to limit the ability of a non-Federal entity or a Federal entity to receive data about its information systems, including lawfully obtained cybersecurity threat indicators;

   Struck: (8) to authorize or prohibit any law enforcement, homeland security, or intelligence activities not otherwise authorized or prohibited under another provision of law;

   Struck: (9) to permit price-fixing, allocating a market between competitors, monopolizing or attempting to monopolize a market, boycotting, or exchanges of price or cost information, customer lists, or information regarding future competitive planning;

   Struck: (10) to authorize or limit liability for actions that would violate the regulations adopted by the Federal Communications Commission on preserving the open Internet, or any successor regulations thereto, nor to modify or alter the obligations of private entities under such regulations; or

   Struck: (11) to prevent a governmental entity from using information not acquired through a cybersecurity exchange for regulatory purposes.

   Struck: (b) Federal Preemption.--This title supersedes any law or requirement of a State or political subdivision of a State that restricts or otherwise expressly regulates the provision of cybersecurity services or the acquisition, interception, retention, use or disclosure of communications, records, or other information by private entities to the extent such law contains requirements inconsistent with this title.

   Struck: (c) Preservation of Other State Law.--Except as expressly provided, nothing in this title shall be construed to preempt the applicability of any other State law or requirement.

   Struck: (d) No Creation of a Right to Information.--The provision of information to a non-Federal entity under this title does not create a right or benefit to similar information by any other non-Federal entity.

   Struck: (e) Prohibition on Requirement to Provide Information to the Federal Government.--Nothing in this title may be construed to permit a Federal entity--

   Struck: (1) to require a non-Federal entity to share information with the Federal Government;

   Struck: (2) to condition the disclosure of unclassified or classified cybersecurity threat indicators pursuant to this title with a non-Federal entity on the provision of cybersecurity threat information to the Federal Government; or

   Struck: (3) to condition the award of any Federal grant, contract or purchase on the provision of cybersecurity threat indicators to a Federal entity, if the provision of such indicators does not reasonably relate to the nature of activities, goods, or services covered by the award.

   Struck: (f) Limitation on Use of Information.--No cybersecurity threat indicators obtained pursuant to this title may be used, retained, or disclosed by a Federal entity or non-Federal entity, except as authorized under this title.

   Struck: (g) Declassification and Sharing of Information.--Consistent with the exemptions from public disclosure of section 704(d), the Director of National Intelligence, in consultation with the Secretary and the head of the Federal entity in possession of the information, shall facilitate the declassification and sharing of information in the possession of a Federal entity that is related to cybersecurity threats, as the Director deems appropriate.

   Struck: (h) Report on Implementation.--Not later than 2 years after the date of the enactment of this title, the Secretary, the Director of National Intelligence, the Attorney General, and the Secretary of Defense shall jointly submit to Congress a report that--

   Struck: (1) describes the extent to which the authorities conferred by this title have enabled the Federal Government and the private sector to mitigate cybersecurity threats;

   Struck: (2) discloses any significant acts of noncompliance by a non-Federal entity with this title, with special emphasis on privacy and civil liberties, and any measures taken by the Federal Government to uncover such noncompliance;

   Struck: (3) describes in general terms the nature and quantity of information disclosed and received by governmental entities and private entities under this title; and

   Struck: (4) identifies the emergence of new threats or technologies that challenge the adequacy of the law, including the definitions, authorities and requirements of this title, for keeping pace with the threat.

   Struck: (i) Requirement for Annual Report.--On an annual basis, the Director of National Intelligence shall provide a report to the Select Committee on Intelligence of the Senate and the Permanent Select Committee on Intelligence of the House of Representatives on the implementation of section 705. Such report, which shall be submitted in a classified and in an unclassified form, shall include a list of private entities that receive classified cybersecurity threat indicators under this title, except that the unclassified report shall not contain information that may be used to identify specific private entities unless such private entities consent to such identification.

   Struck: SEC. 708. DEFINITIONS.

   Struck: In this title:

   Struck: (1) Certified entity.--The term "certified entity" means a protected entity, a self-protected entity, or a provider of cybersecurity services that--

   Struck: (A) possesses or is eligible to obtain a security clearance, as determined by the Director of National Intelligence; and

   Struck: (B) is able to demonstrate to the Director of National Intelligence that such provider or such entity can appropriately protect and use classified cybersecurity threat indicators.

   Struck: (2) Countermeasure.--The term "countermeasure" means automated or manual actions to modify, redirect, or block information that is stored on, processed by, or transiting an information system that is known or suspected to contain cybersecurity threat indicators for the purpose of protecting an information system from cybersecurity threats, conducted on an information system owned or operated by or on behalf of the party to be protected or operated by a private entity acting as a provider of electronic communication services, remote computing services, or cybersecurity services to the party to be protected.

   Struck: (3) Cybersecurity crime.--The term "cybersecurity crime" means the violation of a provision of State or Federal law relating to computer crimes, including a violation of any provision of title 18, United States Code, enacted or amended by the Computer Fraud and Abuse Act of 1986 (Public Law 99-474; 100 Stat. 1213).

   Struck: (4) Cybersecurity exchange.--The term "cybersecurity exchange" means any governmental entity or private entity designated by the Secretary of Homeland Security, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, to receive and distribute cybersecurity threat indicators under section 703(a).

   Struck: (5) Cybersecurity services.--The term "cybersecurity services" means products, goods, or services intended to detect, mitigate, or prevent cybersecurity threats.

   Struck: (6) Cybersecurity threat.--The term "cybersecurity threat" means any action that may result in unauthorized access to, exfiltration of, manipulation of, harm of, or impairment to the integrity, confidentiality, or availability of an information system or information that is stored on, processed by, or transiting an information system, except that none of the following shall be considered a cybersecurity threat--

   Struck: (A) actions protected by the first amendment to the Constitution of the United States; and

   Struck: (B) exceeding authorized access of an information system, if such access solely involves a violation of consumer terms of service or consumer licensing agreements.

   Struck: (7) Cybersecurity threat indicator.--The term "cybersecurity threat indicator" means information--

   Struck: (A) that is reasonably necessary to describe--

   Struck: (i) malicious reconnaissance, including anomalous patterns of communications that reasonably appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat;

   Struck: (ii) a method of defeating a technical control;

   Struck: (iii) a technical vulnerability;

   Struck: (iv) a method of defeating an operational control;

   Struck: (v) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a technical control or an operational control;

   Struck: (vi) malicious cyber command and control;

   Struck: (vii) the actual or potential harm caused by an incident, including information exfiltrated as a result of defeating a technical control or an operational control when it is necessary in order to identify or describe a cybersecurity threat;

   Struck: (viii) any other attribute of a cybersecurity threat, if disclosure of such attribute is not otherwise prohibited by law; or

   Struck: (ix) any combination thereof; and

   Struck: (B) from which reasonable efforts have been made to remove information that can be used to identify specific persons unrelated to the cybersecurity threat.

   Struck: (8) Federal cybersecurity center.--The term "Federal cybersecurity center" means the Department of Defense Cyber Crime Center, the Intelligence Community Incident Response Center, the United States Cyber Command Joint Operations Center, the National Cyber Investigative Joint Task Force, the National Security Agency/Central Security Service Threat Operations Center, the United States Computer Emergency Readiness Team, or successors to such centers.

   Struck: (9) Federal entity.--The term "Federal entity" means an agency or department of the United States, or any component, officer, employee, or agent of such an agency or department.

   Struck: (10) Governmental entity.--The term "governmental entity" means any Federal entity and agency or department of a State, local, tribal, or territorial government other than an educational institution, or any component, officer, employee, or agent of such an agency or department.

   Struck: (11) Information system.--The term "information system" means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information, including communications with, or commands to, specialized systems such as industrial and process control systems, telephone switching and private branch exchanges, and environmental control systems.

   Struck: (12) Malicious cyber command and control.--The term "malicious cyber command and control" means a method for remote identification of, access to, or use of, an information system or information that is stored on, processed by, or transiting an information system associated with a known or suspected cybersecurity threat.

   Struck: (13) Malicious reconnaissance.--The term "malicious reconnaissance" means a method for actively probing or passively monitoring an information system for the purpose of discerning technical vulnerabilities of the information system, if such method is associated with a known or suspected cybersecurity threat.

   Struck: (14) Monitor.--The term "monitor" means the interception, acquisition, or collection of information that is stored on, processed by, or transiting an information system for the purpose of identifying cybersecurity threats.

   Struck: (15) Non-federal entity.--The term "non-Federal entity" means a private entity or a governmental entity other than a Federal entity.

   Struck: (16) Operational control.--The term "operational control" means a security control for an information system that primarily is implemented and executed by people.

   Struck: (17) Private entity.--The term "private entity" has the meaning given the term "person" in section 1 of title 1, United States Code, and does not include a governmental entity.

   Struck: (18) Protect.--The term "protect" means actions undertaken to secure, defend, or reduce the vulnerabilities of an information system, mitigate cybersecurity threats, or otherwise enhance information security or the resiliency of information systems or assets.

   Struck: (19) Technical control.--The term "technical control" means a hardware or software restriction on, or audit of, access or use of an information system or information that is stored on, processed by, or transiting an information system that is intended to ensure the confidentiality, integrity, or availability of that system.

   Struck: (20) Technical vulnerability.--The term "technical vulnerability" means any attribute of hardware or software that could enable or facilitate the defeat of a technical control.

   Struck: (21) Third party.--The term "third party" includes Federal entities and non-Federal entities.

   Original wording

   Strike title VII.

Read automatically from the Congressional Record. Check the original before relying on it.

As printed