S.Amdt. 6313

1. Adds Subtitle G--Strengthening International Cybersecurity Engagement SEC. 1281. FINDINGS at the end of title XII

   Adds a section

   In S.Amdt. 5499 as proposed

   (2) Form of report.--The report required by paragraph (1) shall be submitted in unclassified form but may contain a classified annex.

   Inserted: Subtitle G--Strengthening International Cybersecurity Engagement SEC. 1281. FINDINGS.

   Inserted: Congress finds the following:

   Inserted: (1) The stated goal of the United States International Strategy for Cyberspace, launched on May 16, 2011, is to "work internationally to promote an open, interoperable, secure, and reliable information and communications infrastructure that supports international trade and commerce, strengthens international security, and fosters free expression and innovation in which norms of responsible behavior guide states' actions, sustain partnerships, and support the rule of law in cyberspace.".

   Inserted: (2) On April 11, 2017, the 2017 Group of 7 Declaration on Responsible State Behavior in Cyberspace--

   Inserted: (A) recognized "the urgent necessity of increased international cooperation to promote security and stability in cyberspace";

   Inserted: (B) expressed commitment to "promoting a strategic framework for conflict prevention, cooperation and stability in cyberspace, consisting of the recognition of the applicability of existing international law to State behavior in cyberspace, the promotion of voluntary, non-binding norms of responsible State behavior during peacetime, and the development and the implementation of practical cyber confidence building measures (CBMs) between States"; and

   Inserted: (C) reaffirmed that "the same rights that people have offline must also be protected online".

   Inserted: (3) The 2018 National Cyber Strategy states that "[t]he United States will strive to improve international cooperation in investigating malicious cyber activity, including developing solutions to potential barriers to gathering and sharing evidence" and "will promote a framework of responsible state behavior in cyberspace built upon international law, adherence to voluntary non-binding norms of responsible state behavior that apply during peacetime, and the consideration of practical confidence building measures to reduce the risk of conflict stemming from malicious cyber activity".

   Inserted: (4) In its May 28, 2021 consensus report, the United Nations Group of Governmental Experts on Advancing Responsible State Behavior in Cyberspace wrote that countries "should cooperate in developing and applying measures to increase stability and security in the use of ICTs" and "respect and protect human rights and fundamental freedoms, both online and offline in accordance with their respective obligations".

   Inserted: (5) Emerging technologies, such as artificial intelligence, biotechnology, and quantum computing--

   Inserted: (A) have profound implications for global cybersecurity;

   Inserted: (B) are deeply integrated with, and often dependent on, information and communication technologies;

   Show 126 more inserted paragraphsShow less

   Inserted: (C) are exposed to cyber threats and may have cyber vulnerabilities that could cause significant harm, if exploited; and

   Inserted: (D) can be used both offensively and defensively in cyberspace.

   Inserted: SEC. 1282. SENSE OF CONGRESS.

   Inserted: It is the sense of Congress that--

   Inserted: (1) the United States and its allies and partners must cooperate to ensure the security and safety of information and communication technologies to ensure global peace and prosperity and protect democratic institutions, norms, and values;

   Inserted: (2) the United States should engage with adversary nations, as appropriate--

   Inserted: (A) to define responsible norms of behavior in cyberspace;

   Inserted: (B) to address nonstate cybersecurity threats; and

   Inserted: (C) to establish confidence-building measures that reduce the risk of unintended cyber conflict and escalation;

   Inserted: (3) effective international engagement across cyber issues and stakeholders requires strategic planning, focused leadership, dedicated resources and personnel, and continuous monitoring and evaluation;

   Inserted: (4) Federal agencies involved in international cybersecurity engagement--

   Inserted: (A) must ensure that the preconditions described in paragraph (3) are in place; and

   Inserted: (B) must work with each other to ensure that efforts are consistent, coordinated, and nonduplicative; and

   Inserted: (5) United States international cybersecurity engagement--

   Inserted: (A) must draw on the active involvement, expertise, and resources of the private sector and civil society; and

   Inserted: (B) United States international cybersecurity engagement must account for the cybersecurity implications of novel and emerging technologies.

   Inserted: SEC. 1283. STATEMENT OF POLICY.

   Inserted: It shall be the policy of the United States--

   Inserted: (1) to work internationally to promote an open, interoperable, reliable, and secure internet governed by a multi-stakeholder model that--

   Inserted: (A) promotes human rights, democracy, and the rule of law;

   Inserted: (B) respects individual privacy; and

   Inserted: (C) guards against deception, fraud, and theft;

   Inserted: (2) to take an active role in international and multi-stakeholder fora to strengthen existing norms of responsible behavior of cyberspace, including those set forth in the 2015 and 2021 consensus reports of the United Nations Group of Governmental Experts on Advancing Responsible State Behavior in Cyberspace;

   Inserted: (3) to incorporate, as appropriate, the interests, expertise, and resources of the private sector and civil society into international cybersecurity efforts;

   Inserted: (4) to help allies and partners boost their own cyber capabilities and resiliency in order to pursue, defend, and protect shared interests and values;

   Inserted: (5) to support, in collaboration with allies and partners, the innovation, development, and adoption of technologies and technical standards that--

   Inserted: (A) improve cybersecurity; and

   Inserted: (B) sustain a free, open, and secure internet; and

   Inserted: (6) to coordinate international cybersecurity engagement across the Federal Government to ensure that such efforts are consistent and nonduplicative.

   Inserted: SEC. 1284. REPORT ON UNITED STATES INTERNATIONAL CYBERSECURITY EFFORTS.

   Inserted: (a) Defined Term.--In this section, the term "national security strategy" means the national security strategy of the United States required to be transmitted to Congress annually under section 108 of the National Security Act of 1947 (50 U.S.C. 3043).

   Inserted: (b) In General.--Not later than 180 days after the date of the enactment of this Act, and every 3 years thereafter, the Secretary of State, in coordination with the National Cyber Director, the Secretary of Defense, the Director of the National Security Agency, the Secretary of Commerce, the Attorney General, the Secretary of Homeland Security, the Director of the Cybersecurity and Infrastructure Security Agency, and the heads of such other relevant Federal agencies as the Secretary of State considers appropriate, and in consultation with such nongovernmental partners as the Secretary of State considers appropriate, shall--

   Inserted: (1) review United States strategy, programs, and resources pertaining to international engagement on cybersecurity issues, including relevant diplomatic, foreign assistance, and joint law enforcement initiatives; and

   Inserted: (2) submit a report to the appropriate congressional committees that contains the findings of the review conducted pursuant to paragraph (1).

   Inserted: (c) Report Elements.--Each report submitted pursuant to subsection (b)(2) shall indicate--

   Inserted: (1) whether and to what extent previous and ongoing United States international engagements on cybersecurity-related issues have--

   Inserted: (A) reduced the frequency and severity of cyberattacks on United States individuals, businesses, governmental agencies, and other organizations;

   Inserted: (B) reduced cybersecurity risks to United States and allied critical infrastructure;

   Inserted: (C) deterred and disrupted international cybercrime, including ransomware attacks;

   Inserted: (D) induced other countries to endorse and uphold international laws, norms, standards, and principles supporting a free, open, and secure internet, including relevant treaties and international agreements;

   Inserted: (E) improved allies' and partners' cybersecurity capabilities;

   Inserted: (F) fostered allies' and partners' collaboration with the United States on cybersecurity issues, including information sharing, regulatory coordination and improvement, and joint investigatory and law enforcement operations related to cybercrime;

   Inserted: (G) disrupted the laundering of cybercrime proceeds and other illicit financial activities related to cybercrime, including activities involving cryptocurrency and related services and exchanges;

   Inserted: (H) recovered the proceeds of cybercrime; and

   Inserted: (I) supported the innovation and development of new methods and tools for improving cybersecurity;

   Inserted: (2) the key ongoing challenges to achieving the objectives described in paragraph (1);

   Inserted: (3) whether the budgetary resources, technical expertise, legal authorities, and personnel available to the Department of State and other relevant Federal agencies are adequate to achieve the objectives described in paragraph (1);

   Inserted: (4) whether United States international engagements on cybersecurity-related issues adequately mobilize the private sector and civil society;

   Inserted: (5) whether the Department of State is properly organized and coordinated with other Federal agencies to achieve the objectives described in paragraphs (1), (3), and (4);

   Inserted: (6) country-specific strategies for United States international engagement with respect to malign activity in cyberspace by China, Russia, Iran, North Korea, and each country determined to be a state sponsor of international cybercrime; and

   Inserted: (7) any other matters that the Secretary of State considers relevant.

   Inserted: (d) Classification and Publication.--Each report required under subsection (b)(2)--

   Inserted: (1) shall be unclassified, but may include a classified annex; and

   Inserted: (2) shall be published (without its classified annex, if any) on the public website of the Department of State.

   Inserted: (e) Interagency Cooperation.--Upon a request from the Secretary of State, the head of a Federal agency, subject to any applicable restrictions under other provisions of law, shall provide full support and cooperation to the Secretary in carrying out this section, including by providing information necessary to prepare the report and strategy required under subsection (b)(2).

   Inserted: SEC. 1285. ESTABLISHMENT OF CYBERSECURITY ASSISTANCE FUND.

   Inserted: Part II of the Foreign Assistance Act of 1961 (22 U.S.C. 2301 et seq.) is amended by adding at the end the following:

   Inserted: "CHAPTER 10--CYBERSECURITY ASSISTANCE FUND

   Inserted: "SEC. 591. FINDINGS.

   Inserted: "Congress finds the following:

   Inserted: "(1) Increasingly digitized and interconnected social, political, and economic systems have introduced new vulnerabilities for malicious actors to exploit, which threatens economic and national security.

   Inserted: "(2) The rapid development, deployment, and integration of information and communication technologies into all aspects of modern life bring mounting risks of accidents and malicious activity involving such technologies, and their potential consequences.

   Inserted: "(3) Because information and communication technologies are globally manufactured, traded, and networked, the economic and national security of the United State depends greatly on cybersecurity developments and practices in other countries.

   Inserted: "(4) United States assistance to countries and international organizations to bolster civilian cybersecurity capacity can help--

   Inserted: "(A) reduce vulnerability in the information and communication technologies ecosystem; and

   Inserted: "(B) advance national and economic security objectives.

   Inserted: "SEC. 592. AUTHORIZATION OF ASSISTANCE FOR CYBERSECURITY CAPACITY BUILDING.

   Inserted: "(a) Authorization.--The Secretary of State is authorized to provide assistance to foreign governments and organizations, including national and regional institutions, on such terms and conditions as the Secretary may determine, in order to build the cybersecurity capacity of partner countries and organizations.

   Inserted: "(b) Scope of Assistance.--Assistance under this section may include--

   Inserted: "(1) support for the development of national strategies to enhance cybersecurity;

   Inserted: "(2) programs to enhance government-industry collaboration to manage cybersecurity risks and share cybersecurity knowledge;

   Inserted: "(3) expertise on the revision and enactment of criminal laws, policies, and procedures related to cybersecurity threats;

   Inserted: "(4) support for the development of cybersecurity watch, warning, response, and recovery capabilities, including through the development of cybersecurity incident response teams;

   Inserted: "(5) programs to strengthen the government's capacity to detect, investigate, deter, and prosecute cybercrimes;

   Inserted: "(6) programs to build a culture of cybersecurity, increasing awareness of citizenry and industry of their critical role in cybersecurity;

   Inserted: "(7) programs to enhance cybersecurity workforce development;

   Inserted: "(8) support for the development and use of globally relevant information and communication technologies security standards endorsed by bodies that are transparent and invite multi-stakeholder engagement;

   Inserted: "(9) programs to provide information and resources to diplomats engaging in discussions and negotiations around international law, norms, and capacity building measures related to cybersecurity;

   Inserted: "(10) support for multilateral, intergovernmental, and nongovernmental efforts to coordinate cybersecurity capacity building efforts internationally;

   Inserted: "(11) programs that enhance the ability of relevant stakeholders to act collectively against shared cybersecurity threats;

   Inserted: "(12) support for collaboration with the Cybersecurity and Infrastructure Security Agency and other relevant Federal agencies to enhance cybersecurity;

   Inserted: "(13) programs addressing emerging issues relevant to cybersecurity, including security, safety, and resilience concerns related to artificial intelligence, biotechnology, autonomous systems, and other emerging technological domains; and

   Inserted: "(14) such other functions in furtherance of this chapter, as determined by the Secretary of State.

   Inserted: "(c) Responsibility for Policy Decisions and Justification.--The Secretary of State, or a designated Senate-confirmed official of the Department of State, shall be responsible for policy decisions and justifications for cybersecurity capacity support programs under this chapter, including determinations of--

   Inserted: "(1) whether there will be a cybersecurity support program for a country or organization; and

   Inserted: "(2) the amount of funds for each country or organization.

   Inserted: "(d) Detailed Justification for Uses and Purposes of Funds.--As part of the presentation materials for foreign assistance submitted annually to Congress, the Secretary of State or the Secretary's designee shall provide a detailed justification for the uses and purposes of the amounts provided under this chapter, including information concerning--

   Inserted: "(1) the amounts and kinds of cash grant transfers;

   Inserted: "(2) the amounts and kinds of budgetary and balance-of-payments support provided; and

   Inserted: "(3) the amounts and kinds of project assistance provided with such amounts.

   Inserted: "(e) Assistance Under Other Authorities.--The authority granted under this section to provide assistance for cybersecurity capacity building in countries and organizations does not preclude the use of other authorities also available for such purpose.

   Inserted: "(f) Availability of Funds.--Amounts appropriated to carry out this chapter shall be available for--

   Inserted: "(1) civilian cybersecurity programs; and

   Inserted: "(2) supporting military organizations if--

   Inserted: "(A) such organizations are responsible for civilian cybersecurity in their respective countries; and

   Inserted: "(B) such amounts are directed only toward the civilian cybersecurity activities of such organizations.

   Inserted: "(g) Notification Requirements.--Funds may not be obligated for assistance under this section unless the Committee on Foreign Relations of the Senate and the Committee on Foreign Affairs of the House of Representatives are each notified in writing of the amount and nature of the proposed assistance not later than 15 days before making such funds available for assistance.

   Inserted: "SEC. 593. REVIEW OF EMERGENCY ASSISTANCE CAPACITY.

   Inserted: "(a) In General.--The Secretary of State, in consultation with other relevant Federal departments and agencies, including the Department of Defense, the Department of Justice, the Department of Homeland Security, the Department of Commerce, and the Department of Treasury, shall conduct a review that--

   Inserted: "(1) analyzes the Department of State's capacity to promptly and effectively deliver emergency support to countries experiencing major cybersecurity incidents;

   Inserted: "(2) identifies relevant legal, institutional, and resource constraints preventing the support referred to in paragraph (1); and

   Inserted: "(3) develops a plan for resolve such constraints.

   Inserted: "(b) Report.--Not later than 1 year after the date of the enactment of the International Cybercrime Response Act of 2022, the Secretary of State shall submit a report to the Committee on Foreign Relations of the Senate, the Committee on Appropriations of the Senate, the Committee on Foreign Affairs of the House of Representatives, and the Committee on Appropriations of the House of Representatives that contains the results of the review conducted pursuant to subsection (a).

   Inserted: "SEC. 594. AUTHORIZATION OF APPROPRIATIONS.

   Inserted: "There is authorized to be appropriated $150,000,000, during the 5-year period beginning on October 1, 2022, to carry out the purposes of this chapter.".

   Inserted: SEC. 1286. ASSESSMENT, MONITORING, AND EVALUATION OF CYBERSECURITY CAPACITY BUILDING ASSISTANCE.

   Inserted: (a) In General.--Not later than 18 months after the date of the enactment of this Act, the Secretary of State shall--

   Inserted: (1) develop an assessment, monitoring, and evaluation program for cybersecurity capacity building assistance provided by the Department of State to countries and organizations, including assistance provided pursuant to chapter 10 of part II of the Foreign Assistance Act of 1961, as added by section 1285; and

   Inserted: (2) provide a briefing to the Committee on Foreign Relations of the Senate and the Committee on Foreign Affairs of the House of Representatives regarding the program developed pursuant to paragraph (1).

   Inserted: (b) Elements.--The program developed pursuant to subsection (a)(1) shall include--

   Inserted: (1) maintaining a complete list of every cybersecurity capacity building assistance project of the Department of State that has a total budget in excess of $100,000;

   Inserted: (2) regularly evaluating the efficacy and efficiency of cybersecurity capacity building assistance, including--

   Inserted: (A) assessing the overall efficacy and efficiency of the Department of State's cybersecurity capacity building assistance efforts, including whether such efforts are--

   Inserted: (i) appropriately prioritized across different geographies, recipient organizations, and cybersecurity activities;

   Inserted: (ii) aligned with other Department of State and United States cybersecurity initiatives;

   Inserted: (iii) adequately informed by, and integrated with, relevant cybersecurity efforts in the private sector and civil society;

   Inserted: (iv) coordinated with other Federal agencies engaged in international cybersecurity activities, including the Department of Defense, the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency, and the Department of Commerce; and

   Inserted: (v) duplicative of other public or private sector initiatives;

   Inserted: (B) defining measurable project-level evaluation criteria;

   Inserted: (C) individually assessing every project referred to in paragraph (1) against the criteria defined pursuant to subparagraph (B), as applicable; and

   Inserted: (D) identifying relevant human rights and civil liberties concerns pertaining to each project referred to in paragraph (1), and assessing whether and how such concerns have been addressed; and

   Inserted: (3) identifying the lessons learned in carrying out cybersecurity capacity building assistance and recommendations for improving future assistance.

   Inserted: (c) Oversight.--The Secretary of State shall designate a senior official of the Department of State to lead, in coordination with relevant regional and functional bureaus, the ongoing implementation of the program developed pursuant to subsection (a)(1).

   Inserted: (d) GAO Report.--Not later than 18 months after the date of the enactment of this Act, the Comptroller General of the United States Government Accountability Office shall--

   Inserted: (1) evaluate the capacity of Department of State cybersecurity capacity building assistance to achieve desired outcomes in accordance with the framework described in subsection (b); and

   Inserted: (2) publish a report containing the results of the evaluation conducted pursuant to paragraph (1).

   Original wording

   At the end of title XII, add the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed