S.Amdt. 2625

1. Rewrites title VII

   Replaces

   In S. 3414 · Placed on Calendar Senate

   TITLE VII--[struck: INFORMATION][inserted: FACILITATING] SHARING[inserted: OF CYBER THREAT INFORMATION]

   Struck: SEC. 701. AFFIRMATIVE AUTHORITY TO MONITOR AND DEFEND AGAINST CYBERSECURITY THREATS.

   Struck: (a) In General.--Notwithstanding chapter 119, 121, or 206 of title 18, United States Code, the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.), and sections 222 and 705 of the Communications Act of 1934 (47 U.S.C. 222 and 605), any private entity may--

   Struck: (1) monitor its information systems and information that is stored on, processed by, or transiting such information systems for--

   Struck: (A) malicious reconnaissance;

   Show 211 more struck paragraphsShow less

   Struck: (B) efforts to defeat a technical control or an operational control;

   Struck: (C) technical vulnerabilities;

   Struck: (D) efforts to cause a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a technical control or an operational control;

   Struck: (E) malicious cyber command and control;

   Struck: (F) information exfiltrated as a result of defeating a technical control or an operational control;

   Struck: (G) any other attribute of a cybersecurity threat, if monitoring for such attribute is not otherwise prohibited by law; or

   Struck: (H) any combination of subparagraphs (A) through (G);

   Struck: (2) operate countermeasures on its information systems to protect its rights or property from cybersecurity threats;

   Struck: (3) consent to another private entity monitoring or operating countermeasures on its information systems and information that is stored on, processed by, or transiting such information systems in accordance with this section;

   Struck: (4) monitor a third party's information systems and information that is stored on, processed by, or transiting such information systems for the information listed in subparagraphs (A) through (H) of paragraph (1), if--

   Struck: (A) the third party provides express prior consent to such monitoring; and

   Struck: (B) such monitoring would be lawful under paragraph (1) or under any other provision of law if the third party were to perform such monitoring of its own networks; and

   Struck: (5) operate countermeasures on a third party's information systems to protect the third party's rights or property from cybersecurity threats, if--

   Struck: (A) the third party provides express prior consent to such countermeasures; and

   Struck: (B) operating such countermeasures would be lawful under paragraph (2) or under any other provision of law if the third party were to operate such countermeasures on its own information systems to protect its own rights or property.

   Struck: (b) Use and Protection of Information.--A private entity performing monitoring or operating countermeasures under subsection (a)--

   Struck: (1) may use cybersecurity threat indicators acquired under this title, provided such use is solely for the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from cybersecurity threats or mitigating such threats;

   Struck: (2) shall make reasonable efforts to safeguard communications, records, system traffic, or other information that may be used to identify specific persons acquired in the course of such monitoring from unauthorized access or acquisition;

   Struck: (3) shall comply with any lawful restrictions placed on the use of cybersecurity threat indicators, including, if requested, the removal or destruction of information that can be used to identify specific persons from such indicators;

   Struck: (4) may not use cybersecurity threat indicators to gain an unfair competitive advantage to the detriment of the entity that authorized such monitoring or operation of countermeasures; and

   Struck: (5) may use information obtained under any other provision of law.

   Struck: SEC. 702. VOLUNTARY DISCLOSURE OF CYBERSECURITY THREAT INDICATORS AMONG PRIVATE ENTITIES.

   Struck: (a) Authority to Disclose.--Notwithstanding any other provision of law, any private entity may disclose lawfully obtained cybersecurity threat indicators to any other private entity in accordance with this section.

   Struck: (b) Use and Protection of Information.--A private entity disclosing or receiving cybersecurity threat indicators pursuant to subsection (a)--

   Struck: (1) may use, retain, or further disclose such cybersecurity threat indicators solely for the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from cybersecurity threats or mitigating such threats;

   Struck: (2) shall make reasonable efforts to safeguard communications, records, system traffic, or other information that can be used to identify specific persons from unauthorized access or acquisition;

   Struck: (3) shall comply with any lawful restrictions placed on the disclosure or use of cybersecurity threat indicators, including, if requested, the removal of information that may be used to identify specific persons from such indicators; and

   Struck: (4) may not use the cybersecurity threat indicators to gain an unfair competitive advantage to the detriment of the entity that authorized such sharing.

   Struck: (c) Transfers to Unreliable Private Entities Prohibited.--A private entity may not disclose cybersecurity threat indicators to another private entity that the disclosing entity knows--

   Struck: (1) has intentionally or willfully violated the requirements of subsection (b); and

   Struck: (2) is reasonably likely to violate such requirements.

   Struck: SEC. 703. CYBERSECURITY EXCHANGES.

   Struck: (a) Designation of Cybersecurity Exchanges.--The Secretary of Homeland Security, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall establish--

   Struck: (1) a process for designating one or more appropriate civilian Federal entities or non-Federal entities to serve as cybersecurity exchanges to receive and distribute cybersecurity threat indicators;

   Struck: (2) procedures to facilitate and ensure the sharing of classified and unclassified cybersecurity threat indicators in as close to real time as possible with appropriate Federal entities and non-Federal entities in accordance with this title; and

   Struck: (3) a process for identifying certified entities to receive classified cybersecurity threat indicators in accordance with paragraph (2).

   Struck: (b) Purpose.--The purpose of a cybersecurity exchange is to receive and distribute, in as close to real time as possible, cybersecurity threat indicators, and to thereby avoid unnecessary and duplicative Federal bureaucracy for information sharing as provided in this title.

   Struck: (c) Requirement for a Lead Federal Civilian Cybersecurity Exchange.--

   Struck: (1) In general.--The Secretary, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall designate a civilian Federal entity as the lead cybersecurity exchange to serve as a focal point within the Federal Government for cybersecurity information sharing among Federal entities and with non-Federal entities.

   Struck: (2) Responsibilities.--The lead Federal civilian cybersecurity exchange designated under paragraph (1) shall--

   Struck: (A) receive and distribute, in as close to real time as possible, cybersecurity threat indicators in accordance with this title;

   Struck: (B) facilitate information sharing, interaction, and collaboration among and between--

   Struck: (i) Federal entities;

   Struck: (ii) State, local, tribal, and territorial governments;

   Struck: (iii) private entities;

   Struck: (iv) academia;

   Struck: (v) international partners, in consultation with the Secretary of State; and

   Struck: (vi) other cybersecurity exchanges;

   Struck: (C) disseminate timely and actionable cybersecurity threat, vulnerability, mitigation, and warning information lawfully obtained from any source, including alerts, advisories, indicators, signatures, and mitigation and response measures, to appropriate Federal and non-Federal entities in as close to real time as possible, to improve the security and protection of information systems;

   Struck: (D) coordinate with other Federal and non-Federal entities, as appropriate, to integrate information from Federal and non-Federal entities, including Federal cybersecurity centers, non-Federal network or security operation centers, other cybersecurity exchanges, and non-Federal entities that disclose cybersecurity threat indicators under section 704(a), in as close to real time as possible, to provide situational awareness of the United States information security posture and foster information security collaboration among information system owners and operators;

   Struck: (E) conduct, in consultation with private entities and relevant Federal and other governmental entities, regular assessments of existing and proposed information sharing models to eliminate bureaucratic obstacles to information sharing and identify best practices for such sharing; and

   Struck: (F) coordinate with other Federal entities, as appropriate, to compile and analyze information about risks and incidents that threaten information systems, including information voluntarily submitted in accordance with section 704(a) or otherwise in accordance with applicable laws.

   Struck: (3) Schedule for designation.--The designation of a lead Federal civilian cybersecurity exchange under paragraph (1) shall be made concurrently with the issuance of the interim policies and procedures under section 704(g)(3)(D).

   Struck: (d) Additional Civilian Federal Cybersecurity Exchanges.--In accordance with the process and procedures established in subsection (a), the Secretary, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, may designate additional civilian Federal entities to receive and distribute cybersecurity threat indicators, if such entities are subject to the requirements for use, retention, and disclosure of information by a cybersecurity exchange under section 704(b) and the special requirements for Federal entities under section 704(g).

   Struck: (e) Requirements for Non-Federal Cybersecurity Exchanges.--

   Struck: (1) In general.--In considering whether to designate a private entity or any other non-Federal entity as a cybersecurity exchange to receive and distribute cybersecurity threat indicators under section 704, and what entity to designate, the Secretary shall consider the following factors:

   Struck: (A) The net effect that such designation would have on the overall cybersecurity of the United States.

   Struck: (B) Whether such designation could substantially improve such overall cybersecurity by serving as a hub for receiving and sharing cybersecurity threat indicators in as close to real time as possible, including the capacity of the non-Federal entity for performing those functions.

   Struck: (C) The capacity of such non-Federal entity to safeguard cybersecurity threat indicators from unauthorized disclosure and use.

   Struck: (D) The adequacy of the policies and procedures of such non-Federal entity to protect personally identifiable information from unauthorized disclosure and use.

   Struck: (E) The ability of the non-Federal entity to sustain operations using entirely non-Federal sources of funding.

   Struck: (2) Regulations.--The Secretary may promulgate regulations as may be necessary to carry out this subsection.

   Struck: (f) Construction With Other Authorities.--Nothing in this section may be construed to alter the authorities of a Federal cybersecurity center, unless such cybersecurity center is acting in its capacity as a designated cybersecurity exchange.

   Struck: (g) Congressional Notification of Designation of Cybersecurity Exchanges.--

   Struck: (1) In general.--The Secretary, in coordination with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall promptly notify Congress, in writing, of any designation of a cybersecurity exchange under this title.

   Struck: (2) Requirement.--Written notification under paragraph (1) shall include a description of the criteria and processes used to make the designation.

   Struck: SEC. 704. VOLUNTARY DISCLOSURE OF CYBERSECURITY THREAT INDICATORS TO A CYBERSECURITY EXCHANGE.

   Struck: (a) Authority to Disclose.--Notwithstanding any other provision of law, a non-Federal entity may disclose lawfully obtained cybersecurity threat indicators to a cybersecurity exchange in accordance with this section.

   Struck: (b) Use, Retention, and Disclosure of Information by a Cybersecurity Exchange.--A cybersecurity exchange may only use, retain, or further disclose information provided pursuant to subsection (a)--

   Struck: (1) in order to protect information systems from cybersecurity threats and to mitigate cybersecurity threats; or

   Struck: (2) to law enforcement pursuant to subsection (g)(2).

   Struck: (c) Use and Protection of Information Received From a Cybersecurity Exchange.--A non-Federal entity receiving cybersecurity threat indicators from a cybersecurity exchange--

   Struck: (1) may use, retain, or further disclose such cybersecurity threat indicators solely for the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from cybersecurity threats or mitigating such threats;

   Struck: (2) shall make reasonable efforts to safeguard communications, records, system traffic, or other information that can be used to identify specific persons from unauthorized access or acquisition;

   Struck: (3) shall comply with any lawful restrictions placed on the disclosure or use of cybersecurity threat indicators by the cybersecurity exchange or a third party, if the cybersecurity exchange received such information from the third party, including, if requested, the removal of information that can be used to identify specific persons from such indicators; and

   Struck: (4) may not use the cybersecurity threat indicators to gain an unfair competitive advantage to the detriment of the third party that authorized such sharing.

   Struck: (d) Exemption From Public Disclosure.--Any cybersecurity threat indicator disclosed by a non-Federal entity to a cybersecurity exchange pursuant to subsection (a) shall be--

   Struck: (1) exempt from disclosure under section 552(b)(3) of title 5, United States Code, or any comparable State law; and

   Struck: (2) treated as voluntarily shared information under section 552 of title 5, United States Code, or any comparable State law.

   Struck: (e) Exemption From Ex Parte Limitations.--Any cybersecurity threat indicator disclosed by a non-Federal entity to a cybersecurity exchange pursuant to subsection (a) shall not be subject to the rules of any governmental entity or judicial doctrine regarding ex parte communications with a decision making official.

   Struck: (f) Exemption From Waiver of Privilege.--Any cybersecurity threat indicator disclosed by a non-Federal entity to a cybersecurity exchange pursuant to subsection (a) may not be construed to be a waiver of any applicable privilege or protection provided under Federal, State, tribal, or territorial law, including any trade secret protection.

   Struck: (g) Special Requirements for Federal and Law Enforcement Entities.--

   Struck: (1) Receipt, disclosure and use of cybersecurity threat indicators by a federal entity.--

   Struck: (A) Authority to receive and use cybersecurity threat indicators.--A Federal entity that is not a cybersecurity exchange may receive, retain, and use cybersecurity threat indicators from a cybersecurity exchange in order--

   Struck: (i) to protect information systems from cybersecurity threats and to mitigate cybersecurity threats; and

   Struck: (ii) to disclose such cybersecurity threat indicators to law enforcement in accordance with paragraph (2).

   Struck: (B) Authority to disclose cybersecurity threat indicators.--A Federal entity that is not a cybersecurity exchange shall ensure that if disclosing cybersecurity threat indicators to a non-Federal entity under this section, such non-Federal entity shall use or retain such cybersecurity threat indicators in a manner that is consistent with the requirements in--

   Struck: (i) subsection (b) on the use and protection of information; and

   Struck: (ii) paragraph (2).

   Struck: (2) Law enforcement access and use of cybersecurity threat indicators.--

   Struck: (A) Disclosure to law enforcement.--A Federal entity may disclose cybersecurity threat indicators received under this title to a law enforcement entity if--

   Struck: (i) the disclosure is permitted under the procedures developed by the Secretary and approved by the Attorney General under paragraph (3); and

   Struck: (ii) the information appears to pertain--

   Struck: (I) to a cybersecurity crime which has been, is being, or is about to be committed;

   Struck: (II) to an imminent threat of death or serious bodily harm; or

   Struck: (III) to a serious threat to minors, including sexual exploitation and threats to physical safety.

   Struck: (B) Use by law enforcement.--A law enforcement entity may only use cybersecurity threat indicators received by a Federal entity under paragraph (A) in order--

   Struck: (i) to protect information systems from a cybersecurity threat or investigate, prosecute, or disrupt a cybersecurity crime;

   Struck: (ii) to protect individuals from an imminent threat of death or serious bodily harm; or

   Struck: (iii) to protect minors from any serious threat, including sexual exploitation and threats to physical safety.

   Struck: (3) Privacy and civil liberties.--

   Struck: (A) Requirement for policies and procedures.--The Secretary, in consultation with privacy and civil liberties experts, the Director of National Intelligence, and the Secretary of Defense, shall develop and periodically review policies and procedures governing the receipt, retention, use, and disclosure of cybersecurity threat indicators by a Federal entity obtained in connection with activities authorized in this title. Such policies and procedures shall--

   Struck: (i) minimize the impact on privacy and civil liberties, consistent with the need to protect information systems from cybersecurity threats and mitigate cybersecurity threats;

   Struck: (ii) reasonably limit the receipt, retention, use and disclosure of cybersecurity threat indicators associated with specific persons consistent with the need to carry out the responsibilities of this title, including establishing a process for the timely destruction of cybersecurity threat indicators that are received pursuant to this section that do not reasonably appear to be related to the purposes identified in paragraph (1)(A);

   Struck: (iii) include requirements to safeguard cybersecurity threat indicators that may be used to identify specific persons from unauthorized access or acquisition;

   Struck: (iv) include procedures for notifying entities, as appropriate, if information received pursuant to this section is not a cybersecurity threat indicator; and

   Struck: (v) protect the confidentiality of cybersecurity threat indicators associated with specific persons to the greatest extent practicable and require recipients to be informed that such indicators may only be used for the purposes identified in paragraph (1)(A).

   Struck: (B) Adoption of policies and procedures.--The head of an agency responsible for a Federal entity designated as a cybersecurity exchange under section 703 shall adopt and comply with the policies and procedures developed under this paragraph.

   Struck: (C) Review by the attorney general.--The policies and procedures developed under this subsection shall be provided to the Attorney General for review not later than 1 year after the date of the enactment of this title, and shall not be issued without the Attorney General's approval.

   Struck: (D) Requirement for interim policies and procedures.--The Secretary shall issue interim policies and procedures not later than 60 days after the date of the enactment of this title.

   Struck: (E) Provision to congress.--The policies and procedures issued under this title and any amendments to such policies and procedures shall be provided to Congress in an unclassified form and be made public, but may include a classified annex.

   Struck: (4) Oversight.--

   Struck: (A) Requirement for oversight.--The Secretary and the Attorney General shall establish a mandatory program to monitor and oversee compliance with the policies and procedures issued under this subsection.

   Struck: (B) Notification of the attorney general.--The head of each Federal entity that receives information under this title shall--

   Struck: (i) comply with the policies and procedures developed by the Secretary and approved by the Attorney General under paragraph (3);

   Struck: (ii) promptly notify the Attorney General of significant violations of such policies and procedures; and

   Struck: (iii) provide to the Attorney General any information relevant to the violation that the Attorney General requires.

   Struck: (C) Annual report.--On an annual basis, the Chief Privacy and Civil Liberties Officer of the Department of Justice and the Chief Privacy Officer of the Department, in consultation with the most senior privacy and civil liberties officer or officers of any appropriate agencies, shall jointly submit to Congress a report assessing the privacy and civil liberties impact of the governmental activities conducted pursuant to this title.

   Struck: (5) Reports on information sharing.--

   Struck: (A) Privacy and civil liberties oversight board report.--Not later than 2 years after the date of the enactment of this title, and every 2 years thereafter, the Privacy and Civil Liberties Oversight Board shall submit to Congress and the President a report providing--

   Struck: (i) an analysis of the practices of private entities that are performing, monitoring, operating countermeasures, or disclosing cybersecurity threat indicators pursuant to this title;

   Struck: (ii) an assessment of the privacy and civil liberties impact of the activities carried out by the Federal entities under this title; and

   Struck: (iii) recommendations for improvements to or modifications of the law and the policies and procedures established pursuant to paragraph (3) in order to address privacy and civil liberties concerns.

   Struck: (B) Inspectors general annual report.--The Inspector General of the Department, the Inspector General of the Intelligence Community, the Inspector General of the Department of Justice, and the Inspector General of the Department of Defense shall, on an annual basis, jointly submit to Congress a report on the receipt, use and disclosure of information shared with a Federal cybersecurity exchange under this title, including--

   Struck: (i) a review of the use by Federal entities of such information for a purpose other than to protect information systems from cybersecurity threats and to mitigate cybersecurity threats, including law enforcement access and use pursuant to paragraph (2);

   Struck: (ii) a review of the type of information shared with a Federal cybersecurity exchange;

   Struck: (iii) a review of the actions taken by Federal entities based on such information;

   Struck: (iv) appropriate metrics to determine the impact of the sharing of such information with a Federal cybersecurity exchange on privacy and civil liberties;

   Struck: (v) a list of Federal entities receiving such information;

   Struck: (vi) a review of the sharing of such information among Federal entities to identify inappropriate stovepiping of shared information; and

   Struck: (vii) any recommendations of the inspectors general for improvements or modifications to the authorities under this title.

   Struck: (C) Form.--Each report required under this paragraph shall be submitted in unclassified form, but may include a classified annex.

   Struck: (6) Sanctions.--The head of each Federal entity that conducts activities under this title shall develop and enforce appropriate sanctions for officers, employees, or agents of such entities who conducts such activities--

   Struck: (A) outside the normal course of their specified duties;

   Struck: (B) in a manner inconsistent with the discharge of the responsibilities of such entity; or

   Struck: (C) in contravention of the requirements, policies, and procedures required by this subsection.

   Struck: (7) Federal government liability for violations of this title.--

   Struck: (A) In general.--If a Federal entity intentionally or willfully violates a provision of this title or a regulation promulgated under this title, the United States shall be liable to a person adversely affected by such violation in an amount equal to the sum of--

   Struck: (i) the actual damages sustained by the person as a result of the violation or $1,000, whichever is greater; and

   Struck: (ii) the costs of the action together with reasonable attorney fees as determined by the court.

   Struck: (B) Venue.--An action to enforce liability created under this subsection may be brought in the district court of the United States in--

   Struck: (i) the district in which the complainant resides;

   Struck: (ii) the district in which the principal place of business of the complainant is located;

   Struck: (iii) the district in which the Federal entity that disclosed the information is located; or

   Struck: (iv) the District of Columbia.

   Struck: (C) Statute of limitations.--No action shall lie under this subsection unless such action is commenced not later than 2 years after the date of the violation that is the basis for the action.

   Struck: (D) Exclusive cause of action.--A cause of action under this subsection shall be the exclusive means available to a complainant seeking a remedy for a disclosure of information in violation of this title by a Federal entity.

   Struck: SEC. 705. SHARING OF CLASSIFIED CYBERSECURITY THREAT INDICATORS.

   Struck: (a) Sharing of Classified Cybersecurity Threat Indicators.--The procedures established under section 703(a)(2) shall provide that classified cybersecurity threat indicators may only be--

   Struck: (1) shared with certified entities;

   Struck: (2) shared in a manner that is consistent with the need to protect the national security of the United States;

   Struck: (3) shared with a person with an appropriate security clearance to receive such cybersecurity threat indicators; and

   Struck: (4) used by a certified entity in a manner that protects such cybersecurity threat indicators from unauthorized disclosure.

   Struck: (b) Requirement for Guidelines.--Not later than 60 days after the date of the enactment of this title, the Director of National Intelligence shall issue guidelines providing that appropriate Federal officials may, as the Director considers necessary to carry out this title--

   Struck: (1) grant a security clearance on a temporary or permanent basis to an employee of a certified entity;

   Struck: (2) grant a security clearance on a temporary or permanent basis to a certified entity and approval to use appropriate facilities; or

   Struck: (3) expedite the security clearance process for such an employee or entity, if appropriate, in a manner consistent with the need to protect the national security of the United States.

   Struck: (c) Distribution of Procedures and Guidelines.--Following the establishment of the procedures under section 703(a)(2) and the issuance of the guidelines under subsection (b), the Secretary and the Director of National Intelligence shall expeditiously distribute such procedures and guidelines to--

   Struck: (1) appropriate governmental entities and private entities;

   Struck: (2) the Committee on Armed Services, the Committee on Commerce, Science, and Transportation, the Committee on Homeland Security and Governmental Affairs, the Committee on the Judiciary, and the Select Committee on Intelligence of the Senate; and

   Struck: (3) the Committee on Armed Services, the Committee on Energy and Commerce, the Committee on Homeland Security, the Committee on the Judiciary, and the Permanent Select Committee on Intelligence of the House of Representatives.

   Struck: SEC. 706. LIMITATION ON LIABILITY AND GOOD FAITH DEFENSE FOR CYBERSECURITY ACTIVITIES.

   Struck: (a) In General.--No civil or criminal cause of action shall lie or be maintained in any Federal or State court against any entity acting as authorized by this title, and any such action shall be dismissed promptly for activities authorized by this title consisting of--

   Struck: (1) the cybersecurity monitoring activities authorized by paragraph (1), (3) or (4) of section 701(a); or

   Struck: (2) the voluntary disclosure of a lawfully obtained cybersecurity threat indicator--

   Struck: (A) to a cybersecurity exchange pursuant to section 704(a);

   Struck: (B) by a provider of cybersecurity services to a customer of that provider;

   Struck: (C) to a private entity or governmental entity that provides or manages critical infrastructure (as that term is used in section 1016 of the Critical Infrastructures Protection Act of 2001 (42 U.S.C. 5195c)); or

   Struck: (D) to any other private entity under section 702(a), if the cybersecurity threat indicator is also disclosed within a reasonable time to a cybersecurity exchange.

   Struck: (b) Good Faith Defense.--If a civil or criminal cause of action is not barred under subsection (a), a reasonable good faith reliance that this title permitted the conduct complained of is a complete defense against any civil or criminal action brought under this title or any other law.

   Struck: (c) Limitation on Use of Cybersecurity Threat Indicators for Regulatory Enforcement Actions.--No Federal entity may use a cybersecurity threat indicator received pursuant to this title as evidence in a regulatory enforcement action against the entity that lawfully shared the cybersecurity threat indicator with a cybersecurity exchange that is a Federal entity.

   Struck: (d) Delay of Notification Authorized for Law Enforcement, National Security, or Homeland Security Purposes.--No civil or criminal cause of action shall lie or be maintained in any Federal or State court against any entity, and any such action shall be dismissed promptly, for a failure to disclose a cybersecurity threat indicator if--

   Struck: (1) the Attorney General or the Secretary determines that disclosure of a cybersecurity threat indicator would impede a civil or criminal investigation and submits a written request to delay notification for up to 30 days, except that the Attorney General or the Secretary may, by a subsequent written request, revoke such delay or extend the period of time set forth in the original request made under this paragraph if further delay is necessary; or

   Struck: (2) the Secretary, the Attorney General, or the Director of National Intelligence determines that disclosure of a cybersecurity threat indicator would threaten national or homeland security and submits a written request to delay notification, except that the Secretary, the Attorney General, or the Director, may, by a subsequent written request, revoke such delay or extend the period of time set forth in the original request made under this paragraph if further delay is necessary.

   Struck: (e) Limitation on Liability for Failure to Act.--No civil or criminal cause of action shall lie or be maintained in any Federal or State court against any private entity, or any officer, employee, or agent of such an entity, and any such action shall be dismissed promptly, for the reasonable failure to act on information received under this title.

   Struck: (f) Defense for Breach of Contract.--Compliance with lawful restrictions placed on the disclosure or use of cybersecurity threat indicators is a complete defense to any tort or breach of contract claim originating in a failure to disclose cybersecurity threat indicators to a third party.

   Struck: (g) Limitation on Liability Protections.--Any person who, knowingly or acting in gross negligence, violates a provision of this title or a regulation promulgated under this title shall--

   Struck: (1) not receive the protections of this title; and

   Struck: (2) be subject to any criminal or civil cause of action that may arise under any other State or Federal law prohibiting the conduct in question.

   Struck: SEC. 707. CONSTRUCTION AND FEDERAL PREEMPTION.

   Struck: (a) Construction.--Nothing in this title may be construed--

   Struck: (1) to limit any other existing authority or lawful requirement to monitor information systems and information that is stored on, processed by, or transiting such information systems, operate countermeasures, and retain, use or disclose lawfully obtained information;

   Struck: (2) to permit the unauthorized disclosure of--

   Struck: (A) information that has been determined by the Federal Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations;

   Struck: (B) any restricted data (as that term is defined in paragraph (y) of section 11 of the Atomic Energy Act of 1954 (42 U.S.C. 2014));

   Struck: (C) information related to intelligence sources and methods; or

   Struck: (D) information that is specifically subject to a court order or a certification, directive, or other authorization by the Attorney General precluding such disclosure;

   Struck: (3) to provide additional authority to, or modify an existing authority of, the Department of Defense or the National Security Agency or any other element of the intelligence community to control, modify, require, or otherwise direct the cybersecurity efforts of a non-Federal entity or a Federal entity;

   Struck: (4) to limit or modify an existing information sharing relationship;

   Struck: (5) to prohibit a new information sharing relationship;

   Struck: (6) to require a new information sharing relationship between a Federal entity and a private entity;

   Struck: (7) to limit the ability of a non-Federal entity or a Federal entity to receive data about its information systems, including lawfully obtained cybersecurity threat indicators;

   Struck: (8) to authorize or prohibit any law enforcement, homeland security, or intelligence activities not otherwise authorized or prohibited under another provision of law;

   Struck: (9) to permit price-fixing, allocating a market between competitors, monopolizing or attempting to monopolize a market, boycotting, or exchanges of price or cost information, customer lists, or information regarding future competitive planning;

   Struck: (10) to authorize or limit liability for actions that would violate the regulations adopted by the Federal Communications Commission on preserving the open Internet, or any successor regulations thereto, nor to modify or alter the obligations of private entities under such regulations; or

   Struck: (11) to prevent a governmental entity from using information not acquired through a cybersecurity exchange for regulatory purposes.

   Struck: (b) Federal Preemption.--This title supersedes any law or requirement of a State or political subdivision of a State that restricts or otherwise expressly regulates the provision of cybersecurity services or the acquisition, interception, retention, use or disclosure of communications, records, or other information by private entities to the extent such law contains requirements inconsistent with this title.

   Struck: (c) Preservation of Other State Law.--Except as expressly provided, nothing in this title shall be construed to preempt the applicability of any other State law or requirement.

   Struck: (d) No Creation of a Right to Information.--The provision of information to a non-Federal entity under this title does not create a right or benefit to similar information by any other non-Federal entity.

   Struck: (e) Prohibition on Requirement to Provide Information to the Federal Government.--Nothing in this title may be construed to permit a Federal entity--

   Struck: (1) to require a non-Federal entity to share information with the Federal Government;

   Struck: (2) to condition the disclosure of unclassified or classified cybersecurity threat indicators pursuant to this title with a non-Federal entity on the provision of cybersecurity threat information to the Federal Government; or

   Struck: (3) to condition the award of any Federal grant, contract or purchase on the provision of cybersecurity threat indicators to a Federal entity, if the provision of such indicators does not reasonably relate to the nature of activities, goods, or services covered by the award.

   Struck: (f) Limitation on Use of Information.--No cybersecurity threat indicators obtained pursuant to this title may be used, retained, or disclosed by a Federal entity or non-Federal entity, except as authorized under this title.

   Struck: (g) Declassification and Sharing of Information.--Consistent with the exemptions from public disclosure of section 704(d), the Director of National Intelligence, in consultation with the Secretary and the head of the Federal entity in possession of the information, shall facilitate the declassification and sharing of information in the possession of a Federal entity that is related to cybersecurity threats, as the Director deems appropriate.

   Struck: (h) Report on Implementation.--Not later than 2 years after the date of the enactment of this title, the Secretary, the Director of National Intelligence, the Attorney General, and the Secretary of Defense shall jointly submit to Congress a report that--

   Struck: (1) describes the extent to which the authorities conferred by this title have enabled the Federal Government and the private sector to mitigate cybersecurity threats;

   Struck: (2) discloses any significant acts of noncompliance by a non-Federal entity with this title, with special emphasis on privacy and civil liberties, and any measures taken by the Federal Government to uncover such noncompliance;

   Struck: (3) describes in general terms the nature and quantity of information disclosed and received by governmental entities and private entities under this title; and

   Struck: (4) identifies the emergence of new threats or technologies that challenge the adequacy of the law, including the definitions, authorities and requirements of this title, for keeping pace with the threat.

   Struck: (i) Requirement for Annual Report.--On an annual basis, the Director of National Intelligence shall provide a report to the Select Committee on Intelligence of the Senate and the Permanent Select Committee on Intelligence of the House of Representatives on the implementation of section 705. Such report, which shall be submitted in a classified and in an unclassified form, shall include a list of private entities that receive classified cybersecurity threat indicators under this title, except that the unclassified report shall not contain information that may be used to identify specific private entities unless such private entities consent to such identification.

   SEC. [struck: 708][inserted: 701]. DEFINITIONS.

   In this title:

   Struck: (1) Certified entity.--The term "certified entity" means a protected entity, a self-protected entity, or a provider of cybersecurity services that--

   Struck: (A) possesses or is eligible to obtain a security clearance, as determined by the Director of National Intelligence; and

   Struck: (B) is able to demonstrate to the Director of National Intelligence that such provider or such entity can appropriately protect and use classified cybersecurity threat indicators.

   Struck: (2) Countermeasure.--The term "countermeasure" means automated or manual actions to modify, redirect, or block information that is stored on, processed by, or transiting an information system that is known or suspected to contain cybersecurity threat indicators for the purpose of protecting an information system from cybersecurity threats, conducted on an information system owned or operated by or on behalf of the party to be protected or operated by a private entity acting as a provider of electronic communication services, remote computing services, or cybersecurity services to the party to be protected.

   Show 27 more struck paragraphsShow less

   Struck: (3) Cybersecurity crime.--The term "cybersecurity crime" means the violation of a provision of State or Federal law relating to computer crimes, including a violation of any provision of title 18, United States Code, enacted or amended by the Computer Fraud and Abuse Act of 1986 (Public Law 99-474; 100 Stat. 1213).

   Struck: (4) Cybersecurity exchange.--The term "cybersecurity exchange" means any governmental entity or private entity designated by the Secretary of Homeland Security, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, to receive and distribute cybersecurity threat indicators under section 703(a).

   Struck: (5) Cybersecurity services.--The term "cybersecurity services" means products, goods, or services intended to detect, mitigate, or prevent cybersecurity threats.

   Struck: (6) Cybersecurity threat.--The term "cybersecurity threat" means any action that may result in unauthorized access to, exfiltration of, manipulation of, harm of, or impairment to the integrity, confidentiality, or availability of an information system or information that is stored on, processed by, or transiting an information system, except that none of the following shall be considered a cybersecurity threat--

   Struck: (A) actions protected by the first amendment to the Constitution of the United States; and

   Struck: (B) exceeding authorized access of an information system, if such access solely involves a violation of consumer terms of service or consumer licensing agreements.

   Struck: (7) Cybersecurity threat indicator.--The term "cybersecurity threat indicator" means information--

   Struck: (A) that is reasonably necessary to describe--

   Struck: (i) malicious reconnaissance, including anomalous patterns of communications that reasonably appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat;

   Struck: (ii) a method of defeating a technical control;

   Struck: (iii) a technical vulnerability;

   Struck: (iv) a method of defeating an operational control;

   Struck: (v) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a technical control or an operational control;

   Struck: (vi) malicious cyber command and control;

   Struck: (vii) the actual or potential harm caused by an incident, including information exfiltrated as a result of defeating a technical control or an operational control when it is necessary in order to identify or describe a cybersecurity threat;

   Struck: (viii) any other attribute of a cybersecurity threat, if disclosure of such attribute is not otherwise prohibited by law; or

   Struck: (ix) any combination thereof; and

   Struck: (B) from which reasonable efforts have been made to remove information that can be used to identify specific persons unrelated to the cybersecurity threat.

   Struck: (8) Federal cybersecurity center.--The term "Federal cybersecurity center" means the Department of Defense Cyber Crime Center, the Intelligence Community Incident Response Center, the United States Cyber Command Joint Operations Center, the National Cyber Investigative Joint Task Force, the National Security Agency/Central Security Service Threat Operations Center, the United States Computer Emergency Readiness Team, or successors to such centers.

   Struck: (9) Federal entity.--The term "Federal entity" means an agency or department of the United States, or any component, officer, employee, or agent of such an agency or department.

   Struck: (10) Governmental entity.--The term "governmental entity" means any Federal entity and agency or department of a State, local, tribal, or territorial government other than an educational institution, or any component, officer, employee, or agent of such an agency or department.

   Struck: (11) Information system.--The term "information system" means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information, including communications with, or commands to, specialized systems such as industrial and process control systems, telephone switching and private branch exchanges, and environmental control systems.

   Struck: (12) Malicious cyber command and control.--The term "malicious cyber command and control" means a method for remote identification of, access to, or use of, an information system or information that is stored on, processed by, or transiting an information system associated with a known or suspected cybersecurity threat.

   Struck: (13) Malicious reconnaissance.--The term "malicious reconnaissance" means a method for actively probing or passively monitoring an information system for the purpose of discerning technical vulnerabilities of the information system, if such method is associated with a known or suspected cybersecurity threat.

   Struck: (14) Monitor.--The term "monitor" means the interception, acquisition, or collection of information that is stored on, processed by, or transiting an information system for the purpose of identifying cybersecurity threats.

   Struck: (15) Non-federal entity.--The term "non-Federal entity" means a private entity or a governmental entity other than a Federal entity.

   Struck: (16) Operational control.--The term "operational control" means a security control for an information system that primarily is implemented and executed by people.

   ([struck: 17][inserted: 1]) [struck: Private entity][inserted: Agency].--The term "[struck: private entity][inserted: agency]" has the meaning given the term [struck: "person" ]in section [struck: 1][inserted: 3502] of title [struck: 1][inserted: 44], United States Code[struck: , and does not include a governmental entity].

   Struck: (18) Protect.--The term "protect" means actions undertaken to secure, defend, or reduce the vulnerabilities of an information system, mitigate cybersecurity threats, or otherwise enhance information security or the resiliency of information systems or assets.

   Struck: (19) Technical control.--The term "technical control" means a hardware or software restriction on, or audit of, access or use of an information system or information that is stored on, processed by, or transiting an information system that is intended to ensure the confidentiality, integrity, or availability of that system.

   Struck: (20) Technical vulnerability.--The term "technical vulnerability" means any attribute of hardware or software that could enable or facilitate the defeat of a technical control.

   Struck: (21) Third party.--The term "third party" includes Federal entities and non-Federal entities.

   Inserted: (2) Antitrust laws.--The term "antitrust laws"--

   Inserted: (A) has the meaning given the term in section 1(a) of the Clayton Act (15 U.S.C. 12(a));

   Inserted: (B) includes section 5 of the Federal Trade Commission Act (15 U.S.C. 45) to the extent that section 5 of that Act applies to unfair methods of competition; and

   Inserted: (C) includes any State law that has the same intent and effect as the laws under subparagraphs (A) and (B).

   Inserted: (3) Countermeasure.--The term "countermeasure" means an automated or a manual action with defensive intent to mitigate cyber threats.

   Inserted: (4) Cyber threat information.--The term "cyber threat information" means information that indicates or describes--

   Inserted: (A) a technical or operation vulnerability or a cyber threat mitigation measure;

   Inserted: (B) an action or operation to mitigate a cyber threat;

   Inserted: (C) malicious reconnaissance, including anomalous patterns of network activity that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat;

   Inserted: (D) a method of defeating a technical control;

   Inserted: (E) a method of defeating an operational control;

   Inserted: (F) network activity or protocols known to be associated with a malicious cyber actor or that signify malicious cyber intent;

   Show 147 more inserted paragraphsShow less

   Inserted: (G) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to inadvertently enable the defeat of a technical or operational control;

   Inserted: (H) any other attribute of a cybersecurity threat or cyber defense information that would foster situational awareness of the United States cybersecurity posture, if disclosure of such attribute or information is not otherwise prohibited by law;

   Inserted: (I) the actual or potential harm caused by a cyber incident, including information exfiltrated when it is necessary in order to identify or describe a cybersecurity threat; or

   Inserted: (J) any combination of subparagraphs (A) through (I).

   Inserted: (5) Cybersecurity center.--The term "cybersecurity center" means the Department of Defense Cyber Crime Center, the Intelligence Community Incident Response Center, the United States Cyber Command Joint Operations Center, the National Cyber Investigative Joint Task Force, the National Security Agency/Central Security Service Threat Operations Center, the National Cybersecurity and Communications Integration Center, and any successor center.

   Inserted: (6) Cybersecurity system.--The term "cybersecurity system" means a system designed or employed to ensure the integrity, confidentiality, or availability of, or to safeguard, a system or network, including measures intended to protect a system or network from--

   Inserted: (A) efforts to degrade, disrupt, or destroy such system or network; or

   Inserted: (B) theft or misappropriations of private or government information, intellectual property, or personally identifiable information.

   Inserted: (7) Entity.--

   Inserted: (A) In general.--The term "entity" means any private entity, non-Federal government agency or department, or State, tribal, or local government agency or department (including an officer, employee, or agent thereof).

   Inserted: (B) Inclusions.--The term "entity" includes a government agency or department (including an officer, employeee, or agent thereof) of the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, Guam, American Samoa, the Northern Mariana Islands, and any other territory or possession of the United States.

   Inserted: (8) Federal information system.--The term "Federal information system" means an information system of a Federal department or agency used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency.

   Inserted: (9) Information security.--The term "information security" means protecting information and information systems from disruption or unauthorized access, use, disclosure, modification, or destruction in order to provide--

   Inserted: (A) integrity, by guarding against improper information modification or destruction, including by ensuring information nonrepudiation and authenticity;

   Inserted: (B) confidentiality, by preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; or

   Inserted: (C) availability, by ensuring timely and reliable access to and use of information.

   Inserted: (10) Information system.--The term "information system" has the meaning given the term in section 3502 of title 44, United States Code.

   Inserted: (11) Local government.--The term "local government" means any borough, city, county, parish, town, township, village, or other general purpose political subdivision of a State.

   Inserted: (12) Malicious reconnaissance.--The term "malicious reconnaissance" means a method for actively probing or passively monitoring an information system for the purpose of discerning technical vulnerabilities of the information system, if such method is associated with a known or suspected cybersecurity threat.

   Inserted: (13) Operational control.--The term "operational control" means a security control for an information system that primarily is implemented and executed by people.

   Inserted: (14) Operational vulnerability.--The term "operational vulnerability" means any attribute of policy, process, or procedure that could enable or facilitate the defeat of an operational control.

   Inserted: (15) Private entity.--The term "private entity" means any individual or any private group, organization, or corporation, including an officer, employee, or agent thereof.

   Inserted: (16) Significant cyber incident.--The term "significant cyber incident" means a cyber incident resulting in, or an attempted cyber incident that, if successful, would have resulted in--

   Inserted: (A) the exfiltration from a Federal information system of data that is essential to the operation of the Federal information system; or

   Inserted: (B) an incident in which an operational or technical control essential to the security or operation of a Federal information system was defeated.

   Inserted: (17) Technical control.--The term "technical control" means a hardware or software restriction on, or audit of, access or use of an information system or information that is stored on, processed by, or transiting an information system that is intended to ensure the confidentiality, integrity, or availability of that system.

   Inserted: (18) Technical vulnerability.--The term "technical vulnerability" means any attribute of hardware or software that could enable or facilitate the defeat of a technical control.

   Inserted: (19) Tribal.--The term "tribal" has the meaning given the term "Indian tribe" in section 4 of the Indian Self-Determination and Education Assistance Act (25 U.S.C. 450b).

   Inserted: SEC. 702. AUTHORIZATION TO SHARE CYBER THREAT INFORMATION.

   Inserted: (a) Voluntary Disclosure.--

   Inserted: (1) Private entities.--Notwithstanding any other provision of law, a private entity may, for the purpose of preventing, investigating, or otherwise mitigating threats to information security, on its own networks, or as authorized by another entity, on such entity's networks, employ countermeasures and use cybersecurity systems in order to obtain, identify, or otherwise possess cyber threat information.

   Inserted: (2) Entities.--Notwithstanding any other provision of law, an entity may disclose cyber threat information to--

   Inserted: (A) a cybersecurity center; or

   Inserted: (B) any other entity in order to assist with preventing, investigating, or otherwise mitigating threats to information security.

   Inserted: (3) Information security providers.--If the cyber threat information described in paragraph (1) is obtained, identified, or otherwise possessed in the course of providing information security products or services under contract to another entity, that entity shall be given, at any time prior to disclosure of such information, a reasonable opportunity to authorize or prevent such disclosure, to request anonymization of such information, or to request that reasonable efforts be made to safeguard such information that identifies specific persons from unauthorized access or disclosure.

   Inserted: (b) Significant Cyber Incidents Involving Federal Information Systems.--

   Inserted: (1) In general.--An entity providing electronic communication services, remote computing services, or information security services to a Federal department or agency shall inform the Federal department or agency of a significant cyber incident involving the Federal information system of that Federal department or agency that--

   Inserted: (A) is directly known to the entity as a result of providing such services;

   Inserted: (B) is directly related to the provision of such services by the entity; and

   Inserted: (C) as determined by the entity, has impeded or will impede the performance of a critical mission of the Federal department or agency.

   Inserted: (2) Advance coordination.--A Federal department or agency receiving the services described in paragraph (1) shall coordinate in advance with an entity described in paragraph (1) to develop the parameters of any information that may be provided under paragraph (1), including clarification of the type of significant cyber incident that will impede the performance of a critical mission of the Federal department or agency.

   Inserted: (3) Report.--A Federal department or agency shall report information provided under this subsection to a cybersecurity center.

   Inserted: (4) Construction.--Any information provided to a cybersecurity center under paragraph (3) shall be treated in the same manner as information provided to a cybersecurity center under subsection (a).

   Inserted: (c) Information Shared With or Provided to a Cybersecurity Center.--Cyber threat information provided to a cybersecurity center under this section--

   Inserted: (1) may be disclosed to, retained by, and used by, consistent with otherwise applicable Federal law, any Federal agency or department, component, officer, employee, or agent of the Federal government for a cybersecurity purpose, a national security purpose, or in order to prevent, investigate, or prosecute any of the offenses listed in section 2516 of title 18, United States Code, and such information shall not be disclosed to, retained by, or used by any Federal agency or department for any use not permitted under this paragraph;

   Inserted: (2) may, with the prior written consent of the entity submitting such information, be disclosed to and used by a State, tribal, or local government or government agency for the purpose of protecting information systems, or in furtherance of preventing, investigating, or prosecuting a criminal act, except that if the need for immediate disclosure prevents obtaining written consent, such consent may be provided orally with subsequent documentation of such consent;

   Inserted: (3) shall be considered the commercial, financial, or proprietary information of the entity providing such information to the Federal government and any disclosure outside the Federal government may only be made upon the prior written consent by such entity and shall not constitute a waiver of any applicable privilege or protection provided by law, except that if the need for immediate disclosure prevents obtaining written consent, such consent may be provided orally with subsequent documentation of such consent;

   Inserted: (4) shall be deemed voluntarily shared information and exempt from disclosure under section 552 of title 5, United States Code, and any State, tribal, or local law requiring disclosure of information or records;

   Inserted: (5) shall be, without discretion, withheld from the public under section 552(b)(3)(B) of title 5, United States Code, and any State, tribal, or local law requiring disclosure of information or records;

   Inserted: (6) shall not be subject to the rules of any Federal agency or department or any judicial doctrine regarding ex parte communications with a decision-making official;

   Inserted: (7) shall not, if subsequently provided to a State, tribal, or local government or government agency, otherwise be disclosed or distributed to any entity by such State, tribal, or local government or government agency without the prior written consent of the entity submitting such information, notwithstanding any State, tribal, or local law requiring disclosure of information or records, except that if the need for immediate disclosure prevents obtaining written consent, such consent may be provided orally with subsequent documentation of such consent; and

   Inserted: (8) shall not be directly used by any Federal, State, tribal, or local department or agency to regulate the lawful activities of an entity, including activities relating to obtaining, identifying, or otherwise possessing cyber threat information, except that the procedures required to be developed and implemented under this title shall not be considered regulations within the meaning of this paragraph.

   Inserted: (d) Procedures Relating to Information Sharing With a Cybersecurity Center.--Not later than 60 days after the date of enactment of this Act, the heads of each department or agency containing a cybersecurity center shall jointly develop, promulgate, and submit to Congress procedures to ensure that cyber threat information shared with or provided to--

   Inserted: (1) a cybersecurity center under this section--

   Inserted: (A) may be submitted to a cybersecurity center by an entity, to the greatest extent possible, through a uniform, publicly available process or format that is easily accessible on the website of such cybersecurity center, and that includes the ability to provide relevant details about the cyber threat information and written consent to any subsequent disclosures authorized by this paragraph;

   Inserted: (B) shall immediately be further shared with each cybersecurity center in order to prevent, investigate, or otherwise mitigate threats to information security across the Federal government;

   Inserted: (C) is handled by the Federal government in a reasonable manner, including consideration of the need to protect the privacy and civil liberties of individuals through anonymization or other appropriate methods, while fully accomplishing the objectives of this title, and the Federal government may undertake efforts consistent with this subparagraph to limit the impact on privacy and civil liberties of the sharing of cyber threat information with the Federal government; and

   Inserted: (D) except as provided in this section, shall only be used, disclosed, or handled in accordance with the provisions of subsection (c); and

   Inserted: (2) a Federal agency or department under subsection (b) is provided immediately to a cybersecurity center in order to prevent, investigate, or otherwise mitigate threats to information security across the Federal government.

   Inserted: (e) Information Shared Between Entities.--

   Inserted: (1) In general.--An entity sharing cyber threat information with another entity under this title may restrict the use or sharing of such information by such other entity.

   Inserted: (2) Further sharing.--Cyber threat information shared by any entity with another entity under this title--

   Inserted: (A) shall only be further shared in accordance with any restrictions placed on the sharing of such information by the entity authorizing such sharing, such as appropriate anonymization of such information; and

   Inserted: (B) may not be used by any entity to gain an unfair competitive advantage to the detriment of the entity authorizing the sharing of such information, except that the conduct described in paragraph (3) shall not constitute unfair competitive conduct.

   Inserted: (3) Information shared with state, tribal, or local government or government agency.--Cyber threat information shared with a State, tribal, or local government or government agency under this title--

   Inserted: (A) may, with the prior written consent of the entity sharing such information, be disclosed to and used by a State, tribal, or local government or government agency for the purpose of protecting information systems, or in furtherance of preventing, investigating, or prosecuting a criminal act, except if the need for immediate disclosure prevents obtaining written consent, consent may be provided orally with subsequent documentation of the consent;

   Inserted: (B) shall be deemed voluntarily shared information and exempt from disclosure under any State, tribal, or local law requiring disclosure of information or records;

   Inserted: (C) shall not be disclosed or distributed to any entity by the State, tribal, or local government or government agency without the prior written consent of the entity submitting such information, notwithstanding any State, tribal, or local law requiring disclosure of information or records, except if the need for immediate disclosure prevents obtaining written consent, consent may be provided orally with subsequent documentation of the consent; and

   Inserted: (D) shall not be directly used by any State, tribal, or local department or agency to regulate the lawful activities of an entity, including activities relating to obtaining, identifying, or otherwise possessing cyber threat information, except that the procedures required to be developed and implemented under this title shall not be considered regulations within the meaning of this subparagraph.

   Inserted: (4) Antitrust exemption.--The exchange or provision of cyber threat information or assistance between 2 or more private entities under this title shall not be considered a violation of any provision of antitrust laws if exchanged or provided in order to assist with--

   Inserted: (A) facilitating the prevention, investigation, or mitigation of threats to information security; or

   Inserted: (B) communicating or disclosing of cyber threat information to help prevent, investigate or otherwise mitigate the effects of a threat to information security.

   Inserted: (5) No right or benefit.--The provision of cyber threat information to an entity under this section shall not create a right or a benefit to similar information by such entity or any other entity.

   Inserted: (f) Federal Preemption.--

   Inserted: (1) In general.--This section supersedes any statute or other law of a State or political subdivision of a State that restricts or otherwise expressly regulates an activity authorized under this section.

   Inserted: (2) State law enforcement.--Nothing in this section shall be construed to supersede any statute or other law of a State or political subdivision of a State concerning the use of authorized law enforcement techniques.

   Inserted: (3) Public disclosure.--No information shared with or provided to a State, tribal, or local government or government agency pursuant to this section shall be made publicly available pursuant to any State, tribal, or local law requiring disclosure of information or records.

   Inserted: (g) Civil and Criminal Liability.--

   Inserted: (1) General protections.--

   Inserted: (A) Private entities.--No cause of action shall lie or be maintained in any court against any private entity for--

   Inserted: (i) the use of countermeasures and cybersecurity systems as authorized by this title;

   Inserted: (ii) the use, receipt, or disclosure of any cyber threat information as authorized by this title; or

   Inserted: (iii) the subsequent actions or inactions of any lawful recipient of cyber threat information provided by such private entity.

   Inserted: (B) Entities.--No cause of action shall lie or be maintained in any court against any entity for--

   Inserted: (i) the use, receipt, or disclosure of any cyber threat information as authorized by this title; or

   Inserted: (ii) the subsequent actions or inactions of any lawful recipient of cyber threat information provided by such entity.

   Inserted: (2) Construction.--Nothing in this subsection shall be construed as creating any immunity against, or otherwise affecting, any action brought by the Federal government, or any agency or department thereof, to enforce any law, executive order, or procedure governing the appropriate handling, disclosure, and use of classified information.

   Inserted: (h) Otherwise Lawful Disclosures.--Nothing in this section shall be construed to limit or prohibit otherwise lawful disclosures of communications, records, or other information by a private entity to any other governmental or private entity not covered under this section.

   Inserted: (i) Whistleblower Protection.--Nothing in this Act shall be construed to preempt or preclude any employee from exercising rights currently provided under any whistleblower law, rule, or regulation.

   Inserted: (j) Relationship to Other Laws.--The submission of cyber threat information under this section to a cybersecurity center shall not affect any requirement under any other provision of law for an entity to provide information to the Federal government.

   Inserted: SEC. 703. INFORMATION SHARING BY THE FEDERAL GOVERNMENT.

   Inserted: (a) Classified Information.--

   Inserted: (1) Procedures.--Consistent with the protection of intelligence sources and methods, and as otherwise determined appropriate, the Director of National Intelligence and the Secretary of Defense, in consultation with the heads of the appropriate Federal departments or agencies, shall develop and promulgate procedures to facilitate and promote--

   Inserted: (A) the immediate sharing, through the cybersecurity centers, of classified cyber threat information in the possession of the Federal government with appropriately cleared representatives of any appropriate entity; and

   Inserted: (B) the declassification and immediate sharing, through the cybersecurity centers, with any entity or, if appropriate, public availability of cyber threat information in the possession of the Federal government;

   Inserted: (2) Handling of classified information.--The procedures developed under paragraph (1) shall ensure that each entity receiving classified cyber threat information pursuant to this section has acknowledged in writing the ongoing obligation to comply with all laws, executive orders, and procedures concerning the appropriate handling, disclosure, or use of classified information.

   Inserted: (b) Unclassified Cyber Threat Information.--The heads of each department or agency containing a cybersecurity center shall jointly develop and promulgate procedures that ensure that, consistent with the provisions of this section, unclassified, including controlled unclassified, cyber threat information in the possession of the Federal government--

   Inserted: (1) is shared, through the cybersecurity centers, in an immediate and adequate manner with appropriate entities; and

   Inserted: (2) if appropriate, is made publicly available.

   Inserted: (c) Development of Procedures.--

   Inserted: (1) In general.--The procedures developed under this section shall incorporate, to the greatest extent possible, existing processes utilized by sector specific information sharing and analysis centers.

   Inserted: (2) Coordination with entities.--In developing the procedures required under this section, the Director of National Intelligence and the heads of each department or agency containing a cybersecurity center shall coordinate with appropriate entities to ensure that protocols are implemented that will facilitate and promote the sharing of cyber threat information by the Federal government.

   Inserted: (d) Additional Responsibilities of Cybersecurity Centers.--Consistent with section 702, a cybersecurity center shall--

   Inserted: (1) facilitate information sharing, interaction, and collaboration among and between cybersecurity centers and--

   Inserted: (A) other Federal entities;

   Inserted: (B) any entity; and

   Inserted: (C) international partners, in consultation with the Secretary of State;

   Inserted: (2) disseminate timely and actionable cybersecurity threat, vulnerability, mitigation, and warning information, including alerts, advisories, indicators, signatures, and mitigation and response measures, to improve the security and protection of information systems; and

   Inserted: (3) coordinate with other Federal entities, as appropriate, to integrate information from across the Federal government to provide situational awareness of the cybersecurity posture of the United States.

   Inserted: (e) Sharing Within the Federal Government.--The heads of appropriate Federal departments and agencies shall ensure that cyber threat information in the possession of such Federal departments or agencies that relates to the prevention, investigation, or mitigation of threats to information security across the Federal government is shared effectively with the cybersecurity centers.

   Inserted: (f) Submission to Congress.--Not later than 60 days after the date of enactment of this Act, the Director of National Intelligence, in coordination with the appropriate head of a department or an agency containing a cybersecurity center, shall submit the procedures required by this section to Congress.

   Inserted: SEC. 704. CONSTRUCTION.

   Inserted: (a) Information Sharing Relationships.--Nothing in this title shall be construed--

   Inserted: (1) to limit or modify an existing information sharing relationship;

   Inserted: (2) to prohibit a new information sharing relationship;

   Inserted: (3) to require a new information sharing relationship between any entity and the Federal government, except as specified under section 702(b); or

   Inserted: (4) to modify the authority of a department or agency of the Federal government to protect sources and methods and the national security of the United States.

   Inserted: (b) Anti-tasking Restriction.--Nothing in this title shall be construed to permit the Federal government--

   Inserted: (1) to require an entity to share information with the Federal government, except as expressly provided under section 702(b); or

   Inserted: (2) to condition the sharing of cyber threat information with an entity on such entity's provision of cyber threat information to the Federal government.

   Inserted: (c) No Liability for Non-Participation.--Nothing in this title shall be construed to subject any entity to liability for choosing not to engage in the voluntary activities authorized under this title.

   Inserted: (d) Use and Retention of Information.--Nothing in this title shall be construed to authorize, or to modify any existing authority of, a department or agency of the Federal government to retain or use any information shared under section 702 for any use other than a use permitted under subsection 702(c)(1).

   Inserted: (e) No New Funding.--An applicable Federal agency shall carry out the provisions of this title with existing facilities and funds otherwise available, through such means as the head of the agency considers appropriate.

   Inserted: SEC. 705. REPORT ON IMPLEMENTATION.

   Inserted: (a) Content of Report.--Not later than 1 year after the date of enactment of this Act, and biennially thereafter, the heads of each department or agency containing a cybersecurity center shall jointly submit, in coordination with the privacy and civil liberties officials of such departments or agencies and the Privacy and Civil Liberties Oversight Board, a detailed report to Congress concerning the implementation of this title, including--

   Inserted: (1) an assessment of the sufficiency of the procedures developed under section 703 of this Act in ensuring that cyber threat information in the possession of the Federal government is provided in an immediate and adequate manner to appropriate entities or, if appropriate, is made publicly available;

   Inserted: (2) an assessment of whether information has been appropriately classified and an accounting of the number of security clearances authorized by the Federal government for purposes of this title;

   Inserted: (3) a review of the type of cyber threat information shared with a cybersecurity center under section 702 of this Act, including whether such information meets the definition of cyber threat information under section 701, the degree to which such information may impact the privacy and civil liberties of individuals, any appropriate metrics to determine any impact of the sharing of such information with the Federal government on privacy and civil liberties, and the adequacy of any steps taken to reduce such impact;

   Inserted: (4) a review of actions taken by the Federal government based on information provided to a cybersecurity center under section 702 of this Act, including the appropriateness of any subsequent use under section 702(c)(1) of this Act and whether there was inappropriate stovepiping within the Federal government of any such information;

   Inserted: (5) a description of any violations of the requirements of this title by the Federal government;

   Inserted: (6) a classified list of entities that received classified information from the Federal government under section 703 of this Act and a description of any indication that such information may not have been appropriately handled;

   Inserted: (7) a summary of any breach of information security, if known, attributable to a specific failure by any entity or the Federal government to act on cyber threat information in the possession of such entity or the Federal government that resulted in substantial economic harm or injury to a specific entity or the Federal government; and

   Inserted: (8) any recommendation for improvements or modifications to the authorities under this title.

   Inserted: (b) Form of Report.--The report under subsection (a) shall be submitted in unclassified form, but shall include a classified annex.

   Inserted: SEC. 706. INSPECTOR GENERAL REVIEW.

   Inserted: (a) In General.--The Council of the Inspectors General on Integrity and Efficiency are authorized to review compliance by the cybersecurity centers, and by any Federal department or agency receiving cyber threat information from such cybersecurity centers, with the procedures required under section 102 of this Act.

   Inserted: (b) Scope of Review.--The review under subsection (a) shall consider whether the Federal government has handled such cyber threat information in a reasonable manner, including consideration of the need to protect the privacy and civil liberties of individuals through anonymization or other appropriate methods, while fully accomplishing the objectives of this title.

   Inserted: (c) Report to Congress.--Each review conducted under this section shall be provided to Congress not later than 30 days after the date of completion of the review.

   Inserted: SEC. 707. TECHNICAL AMENDMENTS.

   Inserted: Section 552(b) of title 5, United States Code, is amended--

   Inserted: (1) in paragraph (8), by striking "or";

   Inserted: (2) in paragraph (9), by striking "wells." and inserting "wells; or"; and

   Inserted: (3) by adding at the end the following:

   Inserted: "(10) information shared with or provided to a cybersecurity center under section 702 of title I of the Cybersecurity Act of 2012.".

   Inserted: SEC. 708. ACCESS TO CLASSIFIED INFORMATION.

   Inserted: (a) Authorization Required.--No person shall be provided with access to classified information (as defined in section 6.1 of Executive Order 13526 (50 U.S.C. 435 note; relating to classified national security information)) relating to cyber security threats or cyber security vulnerabilities under this title without the appropriate security clearances.

   Inserted: (b) Security Clearances.--The appropriate Federal agencies or departments shall, consistent with applicable procedures and requirements, and if otherwise deemed appropriate, assist an individual in timely obtaining an appropriate security clearance where such individual has been determined to be eligible for such clearance and has a need-to-know (as defined in section 6.1 of that Executive Order) classified information to carry out this title.

   Original wording

   Strike title VII and insert the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed