S.Amdt. 1715

SA 1715. Mr. KING submitted an amendment intended to be proposed by
him to the bill S. 4049, to authorize appropriations for fiscal year
2021 for military activities of the Department of Defense, for military
construction, and for defense activities of the Department of Energy,
to prescribe military personnel strengths for such fiscal year, and for
other purposes; which was ordered to lie on the table; as follows:

At the appropriate place, insert the following:

SEC. ___. BUREAU OF CYBER STATISTICS.

(a) Definitions.--In this section--
(1) the term ``Bureau'' means the Bureau of Cyber
Statistics of the Department of Commerce established under
subsection (b);
(2) the term ``Director'' means the Director of the Bureau;
and
(3) the term ``statistical purpose''--
(A) means the description, estimation, or analysis of the
characteristics of groups without identifying the individuals
or organizations that comprise those groups; and
(B) includes the development, implementation, or
maintenance of methods, technical or administrative
procedures, or information resources that support the duties
and functions of the Director under subsection (d).
(b) Establishment.--There is established within the
Department of Commerce the Bureau of Cyber Statistics.

[[Page S3237]]

(c) Director.--
(1) In general.--The Bureau shall be headed by a Director,
who shall--
(A) report to the Secretary of Commerce; and
(B) be appointed by the President.
(2) Authority.--The Director shall--
(A) have final authority for all cooperative agreements and
contracts entered into by the Bureau;
(B) be responsible for the integrity of data and statistics
collected and retained by the Bureau; and
(C) protect against improper or illegal use or disclosure
of data and statistics collected and retained the Bureau,
consistent with the procedures developed under subsection
(g).
(3) Qualifications.--The Director--
(A) shall have experience in statistical programs; and
(B) may not--
(i) engage in any other employment while serving as the
Director; or
(ii) hold any office in, or act in any capacity for, any
organization, agency, or institution with which the Bureau
enters into any contract or other arrangement under this
section.
(d) Duties and Functions.--The Director shall--
(1) collect and analyze--
(A) information concerning cybersecurity, including data
relating to cyber incidents, cyber crime, and any other area
the Director determines appropriate; and
(B) data that shall serve as a national indication with
respect to the prevalence, rates, extent, distribution,
attributes, and number of all relevant cyber incidents, as
determined by the Director, in support of national policy and
decision making;
(2) compile, collate, analyze, publish, and disseminate
uniform national cyber statistics concerning any area that
the Director determines appropriate;
(3) in coordination with the Director of the National
Institute of Standards and Technology, recommend national
standards, metrics, and measurement criteria for cyber
statistics and for ensuring the reliability and validity of
statistics collected under this section;
(4) conduct or support research relating to methods of
gathering or analyzing cyber statistics;
(5) enter into cooperative agreements or contracts with
public agencies, institutions of higher education, and
private organizations for purposes relating to this section;
(6) provide appropriate information to the President,
Congress, Federal agencies, the private sector, and the
general public on cyber statistics;
(7) communicate with State and local governments concerning
cyber statistics;
(8) as needed, confer and cooperate with Federal
statistical agencies to carry out the purposes of this
section, including by entering into cooperative data sharing
agreements that comply with all laws and regulations
applicable to the disclosure and use of data; and
(9) request from any person or entity information, data,
and reports as may be required to carry out the purposes of
this section.
(e) Furnishing of Information, Data, or Reports by Federal
Departments and Agencies.--A Federal department or agency
that the Director requests to provide information, data, or
reports under subsection (c)(9) shall provide to the Bureau
such information as the Director determines necessary to
carry out the purposes of this section.
(f) Protection of Information.--
(1) In general.--No officer, employee, or agent of the
Federal Government may, without the consent of the individual
or the applicable agency, or the individual who is the
subject of the submission or who provides the submission--
(A) use any submission that is furnished for exclusively
statistical purposes under this section for any purpose other
than the statistical purposes for which the submission is
furnished;
(B) make any publication or media transmittal of the data
contained in the submission described in subparagraph (A) if
that publication or transmittal would permit information
concerning individual entities or incidents to be reasonably
inferred by either direct or indirect means; or
(C) permit anyone other than a sworn officer, employee,
agent, or contractor of the Bureau to examine a submission
described in subsection (e) or (g).
(2) Immunity from legal process.--Any submission (including
any data derived from a submission) that is collected and
retained by the Bureau, or an officer, employee, agent, or
contractor of the Bureau, for exclusively statistical
purposes under this section shall be immune from legal
process and shall not, without the consent of the individual,
entity, agency, or other person that is the subject of the
submission (or that provides the submission), be admitted as
evidence or used for any purpose in any action, suit, or
other judicial or administrative proceeding.
(3) Rule of construction.--Nothing in this subsection may
be construed to provide immunity from legal process for a
submission (including any data derived from a submission) if
the submission is in the possession of any person, agency, or
entity other than the Bureau or an officer, employee, agent,
or contractor of the Bureau, or if the submission is
independently collected, retained, or produced for purposes
other than the purposes of this section.
(g) Private Sector Submission of Data.--
(1) Standards for submission of information.--Not later
than 2 years after the date of enactment of this Act, and
after consultation with relevant stakeholders, the Director
shall develop criteria and standardized procedures with
respect to private entities submitting to the Bureau data
relating to cyber incidents.
(2) Private sector submission.--After the development of
the criteria and standards required under paragraph (1), the
Director shall publish the processes for the submissions
described in that paragraph and shall begin accepting those
submissions.
(3) Report.--Not later than 1 year after the date on which
the Director begins accepting submissions under paragraph
(2), the Director shall submit to Congress a report
detailing--
(A) the rate of submissions by private entities;
(B) an assessment of the procedures for the submissions
described in subparagraph (A); and
(C) an overview of mechanisms for ensuring the collection
of data relating to cyber incidents from private entities
that collect and retain that type of data as part of their
core business activity.
(h) Status of Director Position.--Section 5315 of title 5,
United States Code, is amended by inserting after the item
relating to the Director of the Bureau of the Census the
following:
``Director, Bureau of Cyber Statistics, Department of
Commerce.''.
______