#aacth ,,congress #ast ,session ,h4 ,r4 #fbd ,,an ,,act ,to provide for the sharing of certain cyber threat intelligence and cyber threat information between the intelligence community and cybersecurity entities1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cyber ,intelligence ,sharing and ,protection ,act4 #b4 ,federal ,government coordination with respect to cybersecurity 7a7 ,coordinated activities ,the ,federal ,government shall conduct cybersecurity activities to provide shared situational awareness that enables integrated operational actions to protect1 prevent1 mitigate1 respond to1 and recover from cyber incidents4 7b7 ,coordinated information sharing 7#a7 ,designation of coordinating entity for cyber threat information ,the ,president shall designate an entity within the ,department of ,homeland ,security as the civilian ,federal entity to receive cyber threat information that is shared by a cybersecurity provider or self-protected entity in accordance with section #aajd7;b7 of the ,national ,security ,act of #aidg1 as added by section #c7;a7 of this ,act1 except as provided in paragraph 7#b7 and subject to the procedures established under paragraph 7#d74 7#b7 ,designation of a coordinating entity for cybersecurity crimes ,the ,president shall designate an entity within the ,department of ,justice as the civilian ,federal entity to receive cyber threat information related to cybersecurity crimes that is shared by a cybersecurity provider or self-protected entity in accordance with section #aajd7;b7 of the ,national ,security ,act of #aidg1 as added by section #c7;a7 of this ,act1 subject to the procedures under paragraph 7#d74 7#c7 ,sharing by coordinating entities ,the entities designated under paragraphs 7#a7 and 7#b7 shall share cyber threat information shared with such entities in accordance with section #aajd7;b7 of the ,national ,security ,act of #aidg1 as added by section #c7;a7 of this ,act1 consistent with the procedures established under paragraphs 7#d7 and 7#e74 7#d7 ,procedures ,each department or agency of the ,federal ,government receiving cyber threat information shared in accordance with section #aajd7;b7 of the ,national ,security ,act of #aidg1 as added by section #c7;a7 of this ,act1 shall establish procedures to-- 7,a7 ensure that cyber threat information shared with departments or agencies of the ,federal ,government in accordance with such section #aajd7;b7 is also shared with appropriate departments and agencies of the ,federal ,government with a national security mission in real time2 7,b7 ensure the distribution to other departments and agencies of the ,federal ,government of cyber threat information in real time2 and 7,c7 facilitate information sharing1 interaction1 and collaboration among and between the ,federal ,government2 ,state1 local1 tribal1 and territorial governments2 and cybersecurity providers and self-protected entities4 7#e7 ,privacy and civil liberties 7,a7 ,policies and procedures ,the ,secretary of ,homeland ,security1 the ,attorney ,general1 the ,director of ,national ,intelligence1 and the ,secretary of ,defense shall jointly establish and periodically review policies and procedures governing the receipt1 retention1 use1 and disclosure of non-publicly available cyber threat information shared with the ,federal ,government in accordance with section #aajd7;b7 of the ,national ,security ,act of #aidg1 as added by section #c7;a7 of this ,act4 ,such policies and procedures shall1 consistent with the need to protect systems and networks from cyber threats and mitigate cyber threats in a timely manner-- 7i7 minimize the impact on privacy and civil liberties2 7ii7 reasonably limit the receipt1 retention1 use1 and disclosure of cyber threat information associated with specific persons that is not necessary to protect systems or networks from cyber threats or mitigate cyber threats in a timely manner2 7iii7 include requirements to safeguard non-publicly available cyber threat information that may be used to identify specific persons from unauthorized access or acquisition2 7iv7 protect the confidentiality of cyber threat information associated with specific persons to the greatest extent practicable2 and 7v7 not delay or impede the flow of cyber threat information necessary to defend against or mitigate a cyber threat4 7,b7 ,submission to ,congress ,the ,secretary of ,homeland ,security1 the ,attorney ,general1 the ,director of ,national ,intelligence1 and the ,secretary of ,defense shall1 consistent with the need to protect sources and methods1 jointly submit to ,congress the policies and procedures required under subparagraph 7,a7 and any updates to such policies and procedures4 7,c7 ,implementation ,the head of each department or agency of the ,federal ,government receiving cyber threat information shared with the ,federal ,government under such section #aajd7;b7 shall-- 7i7 implement the policies and procedures established under subparagraph 7,a72 and 7ii7 promptly notify the ,secretary of ,homeland ,security1 the ,attorney ,general1 the ,director of ,national ,intelligence1 the ,secretary of ,defense1 and the appropriate congressional committees of any significant violations of such policies and procedures4 7,d7 ,oversight ,the ,secretary of ,homeland ,security1 the ,attorney ,general1 the ,director of ,national ,intelligence1 and the ,secretary of ,defense shall jointly establish a program to monitor and oversee compliance with the policies and procedures established under subparagraph 7,a74 7#f7 ,information sharing relationships ,nothing in this section shall be construed to-- 7,a7 alter existing agreements or prohibit new agreements with respect to the sharing of cyber threat information between the ,department of ,defense and an entity that is part of the defense industrial base2 7,b7 alter existing information-sharing relationships between a cybersecurity provider1 protected entity1 or self-protected entity and the ,federal ,government2 7,c7 prohibit the sharing of cyber threat information directly with a department or agency of the ,federal ,government for criminal investigative purposes related to crimes described in section #aajd7;c77#a7 of the ,national ,security ,act of #aidg1 as added by section #c7;a7 of this ,act2 or 7,d7 alter existing agreements or prohibit new agreements with respect to the sharing of cyber threat information between the ,department of ,treasury and an entity that is part of the financial services sector4 7#g7 ,technical assistance 7,a7 ,discussions and assistance ,nothing in this section shall be construed to prohibit any department or agency of the ,federal ,government from engaging in formal or informal technical discussion regarding cyber threat information with a cybersecurity provider or self-protected entity or from providing technical assistance to address vulnerabilities or mitigate threats at the request of such a provider or such an entity4 7,b7 ,coordination ,any department or agency of the ,federal ,government engaging in an activity referred to in subparagraph 7,a7 shall coordinate such activity with the entity of the ,department of ,homeland ,security designated under paragraph 7#a7 and share all significant information resulting from such activity with such entity and all other appropriate departments and agencies of the ,federal ,government4 7,c7 ,sharing by designated entity ,consistent with the policies and procedures established under paragraph 7#e71 the entity of the ,department of ,homeland ,security designated under paragraph 7#a7 shall share with all appropriate departments and agencies of the ,federal ,government all significant information resulting from-- 7i7 formal or informal technical discussions between such entity of the ,department of ,homeland ,security and a cybersecurity provider or self-protected entity about cyber threat information2 or 7ii7 any technical assistance such entity of the ,department of ,homeland ,security provides to such cybersecurity provider or such self-protected entity to address vulnerabilities or mitigate threats4 7c7 ,reports on information sharing 7#a7 ,inspector ,general of the ,department of ,homeland ,security report ,the ,inspector ,general of the ,department of ,homeland ,security1 in consultation with the ,inspector ,general of the ,department of ,justice1 the ,inspector ,general of the ,intelligence ,community1 the ,inspector ,general of the ,department of ,defense1 and the ,privacy and ,civil ,liberties ,oversight ,board1 shall annually submit to the appropriate congressional committees a report containing a review of the use of information shared with the ,federal ,government under subsection 7b7 of section #aajd of the ,national ,security ,act of #aidg1 as added by section #c7;a7 of this ,act1 including-- 7,a7 a review of the use by the ,federal ,government of such information for a purpose other than a cybersecurity purpose2 7,b7 a review of the type of information shared with the ,federal ,government under such subsection2 7,c7 a review of the actions taken by the ,federal ,government based on such information2 7,d7 appropriate metrics to determine the impact of the sharing of such information with the ,federal ,government on privacy and civil liberties1 if any2 7,e7 a list of the departments or agencies receiving such information2 7,f7 a review of the sharing of such information within the ,federal ,government to identify inappropriate stovepiping of shared information2 and 7,g7 any recommendations of the ,inspector ,general of the ,department of ,homeland ,security for improvements or modifications to the authorities under such section4 7#b7 ,privacy and civil liberties officers report ,the ,officer for ,civil ,rights and ,civil ,liberties of the ,department of ,homeland ,security1 in consultation with the ,privacy and ,civil ,liberties ,oversight ,board1 the ,inspector ,general of the ,intelligence ,community1 and the senior privacy and civil liberties officer of each department or agency of the ,federal ,government that receives cyber threat information shared with the ,federal ,government under such subsection 7b71 shall annually and jointly submit to ,congress a report assessing the privacy and civil liberties impact of the activities conducted by the ,federal ,government under such section #aajd4 ,such report shall include any recommendations the ,civil ,liberties ,protection ,officer and ,chief ,privacy and ,civil ,liberties ,officer consider appropriate to minimize or mitigate the privacy and civil liberties impact of the sharing of cyber threat information under such section #aajd4 7#c7 ,form ,each report required under paragraph 7#a7 or 7#b7 shall be submitted in unclassified form1 but may include a classified annex4 7d7 ,definitions ,in this section3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security1 the ,committee on the ,judiciary1 the ,permanent ,select ,committee on ,intelligence1 and the ,committee on ,armed ,services of the ,house of ,representatives2 and 7,b7 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on the ,judiciary1 the ,select ,committee on ,intelligence1 and the ,committee on ,armed ,services of the ,senate4 7#b7 ,cyber threat information1 cyber threat intelligence1 cybersecurity crimes1 cybersecurity provider1 cybersecurity purpose1 and self-protected entity ,the terms cyber threat information1 cyber threat intelligence1 cybersecurity crimes1 cybersecurity provider1 cybersecurity purpose1 and self-protected entity have the meaning given those terms in section #aajd of the ,national ,security ,act of #aidg1 as added by section #c7;a7 of this ,act4 7#c7 ,intelligence community ,the term intelligence community has the meaning given the term in section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #dja;a7#d774 7#d7 ,shared situational awareness ,the term shared situational awareness means an environment where cyber threat information is shared in real time between all designated ,federal cyber operations centers to provide actionable information about all known cyber threats4 #c4 ,cyber threat intelligence and information sharing 7a7 ,in general ,title ,,xi of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #ddb et seq47 is amended by adding at the end the following new section3 #aajd4 ,cyber threat intelligence and information sharing 7a7 ,intelligence community sharing of cyber threat intelligence with private sector and utilities 7#a7 ,in general ,the ,director of ,national ,intelligence shall establish procedures to allow elements of the intelligence community to share cyber threat intelligence with private-sector entities and utilities and to encourage the sharing of such intelligence4 7#b7 ,sharing and use of classified intelligence ,the procedures established under paragraph 7#a7 shall provide that classified cyber threat intelligence may only be-- 7,a7 shared by an element of the intelligence community with-- 7i7 a certified entity2 or 7ii7 a person with an appropriate security clearance to receive such cyber threat intelligence2 7,b7 shared consistent with the need to protect the national security of the ,united ,states2 7,c7 used by a certified entity in a manner which protects such cyber threat intelligence from unauthorized disclosure2 and 7,d7 used1 retained1 or further disclosed by a certified entity for cybersecurity purposes4 7#c7 ,security clearance approvals ,the ,director of ,national ,intelligence shall issue guidelines providing that the head of an element of the intelligence community may1 as the head of such element considers necessary to carry out this subsection-- 7,a7 grant a security clearance on a temporary or permanent basis to an employee1 independent contractor1 or officer of a certified entity2 7,b7 grant a security clearance on a temporary or permanent basis to a certified entity and approval to use appropriate facilities2 and 7,c7 expedite the security clearance process for a person or entity as the head of such element considers necessary1 consistent with the need to protect the national security of the ,united ,states4 7#d7 ,no right or benefit ,the provision of information to a private-sector entity or a utility under this subsection shall not create a right or benefit to similar information by such entity or such utility or any other private-sector entity or utility4 7#e7 ,restriction on disclosure of cyber threat intelligence ,notwithstanding any other provision of law1 a certified entity receiving cyber threat intelligence pursuant to this subsection shall not further disclose such cyber threat intelligence to another entity1 other than to a certified entity or other appropriate agency or department of the ,federal ,government authorized to receive such cyber threat intelligence4 7b7 ,use of cybersecurity systems and sharing of cyber threat information 7#a7 ,in general 7,a7 ,cybersecurity providers ,notwithstanding any other provision of law1 a cybersecurity provider1 with the express consent of a protected entity for which such cybersecurity provider is providing goods or services for cybersecurity purposes1 may1 for cybersecurity purposes-- 7i7 use cybersecurity systems to identify and obtain cyber threat information to protect the rights and property of such protected entity2 and 7ii7 share such cyber threat information with any other entity designated by such protected entity1 including1 if specifically designated1 the entities of the ,department of ,homeland ,security and the ,department of ,justice designated under paragraphs 7#a7 and 7#b7 of section #b7;b7 of the ,cyber ,intelligence ,sharing and ,protection ,act4 7,b7 ,self-protected entities ,notwithstanding any other provision of law1 a self-protected entity may1 for cybersecurity purposes-- 7i7 use cybersecurity systems to identify and obtain cyber threat information to protect the rights and property of such self-protected entity2 and 7ii7 share such cyber threat information with any other entity1 including the entities of the ,department of ,homeland ,security and the ,department of ,justice designated under paragraphs 7#a7 and 7#b7 of section #b7;b7 of the ,cyber ,intelligence ,sharing and ,protection ,act4 7#b7 ,use and protection of information ,cyber threat information shared in accordance with paragraph 7#a7-- 7,a7 shall only be shared in accordance with any restrictions placed on the sharing of such information by the protected entity or self-protected entity authorizing such sharing1 including appropriate anonymization or minimization of such information and excluding limiting a department or agency of the ,federal ,government from sharing such information with another department or agency of the ,federal ,government in accordance with this section2 7,b7 may not be used by an entity to gain an unfair competitive advantage to the detriment of the protected entity or the self-protected entity authorizing the sharing of information2 7,c7 may only be used by a non-,federal recipient of such information for a cybersecurity purpose2 7,d7 if shared with the ,federal ,government-- 7i7 shall be exempt from disclosure under section #eeb of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act72 7ii7 shall be considered proprietary information and shall not be disclosed to an entity outside of the ,federal ,government except as authorized by the entity sharing such information2 7iii7 shall not be used by the ,federal ,government for regulatory purposes2 7iv7 shall not be provided to another department or agency of the ,federal ,government under paragraph 7#b77;,a7 if-- 7,i7 the entity providing such information determines that the provision of such information will undermine the purpose for which such information is shared2 or 7,,ii7 unless otherwise directed by the ,president1 the head of the department or agency of the ,federal ,government receiving such cyber threat information determines that the provision of such information will undermine the purpose for which such information is shared2 and 7v7 shall be handled by the ,federal ,government consistent with the need to protect sources and methods and the national security of the ,united ,states2 and 7,e7 shall be exempt from disclosure under a law or regulation of a ,state1 political subdivision of a ,state1 or a tribe that requires public disclosure of information by a public or quasi-public entity4 7#c7 ,exemption from liability 7,a7 ,exemption ,no civil or criminal cause of action shall lie or be maintained in ,federal or ,state court against a protected entity1 self-protected entity1 cybersecurity provider1 or an officer1 employee1 or agent of a protected entity1 self-protected entity1 or cybersecurity provider1 acting in good faith-- 7i7 for using cybersecurity systems to identify or obtain cyber threat information or for sharing such information in accordance with this section2 or 7ii7 for decisions made for cybersecurity purposes and based on cyber threat information identified1 obtained1 or shared under this section4 7,b7 ,lack of good faith ,for purposes of the exemption from liability under subparagraph 7,a71 a lack of good faith includes any act or omission taken with intent to injure1 defraud1 or otherwise endanger any individual1 government entity1 private entity1 or utility4 7#d7 ,relationship to other laws requiring the disclosure of information ,the submission of information under this subsection to the ,federal ,government shall not satisfy or affect-- 7,a7 any requirement under any other provision of law for a person or entity to provide information to the ,federal ,government2 or 7,b7 the applicability of other provisions of law1 including section #eeb of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act71 with respect to information required to be provided to the ,federal ,government under such other provision of law4 7#e7 ,rule of construction ,nothing in this subsection shall be construed to provide new authority to-- 7,a7 a cybersecurity provider to use a cybersecurity system to identify or obtain cyber threat information from a system or network other than a system or network owned or operated by a protected entity for which such cybersecurity provider is providing goods or services for cybersecurity purposes2 or 7,b7 a self-protected entity to use a cybersecurity system to identify or obtain cyber threat information from a system or network other than a system or network owned or operated by such self-protected entity4 7c7 ,federal ,government use of information 7#a7 ,limitation ,the ,federal ,government may use cyber threat information shared with the ,federal ,government in accordance with subsection 7b7-- 7,a7 for cybersecurity purposes2 7,b7 for the investigation and prosecution of cybersecurity crimes2 7,c7 for the protection of individuals from the danger of death or serious bodily harm and the investigation and prosecution of crimes involving such danger of death or serious bodily harm2 or 7,d7 for the protection of minors from child pornography1 any risk of sexual exploitation1 and serious threats to the physical safety of minors1 including kidnapping and trafficking and the investigation and prosecution of crimes involving child pornography1 any risk of sexual exploitation1 and serious threats to the physical safety of minors1 including kidnapping and trafficking1 and any crime referred to in section #bbeh;,a7a77#b7 of title #ah1 ,united ,states ,code4 7#b7 ,affirmative search restriction ,the ,federal ,government may not affirmatively search cyber threat information shared with the ,federal ,government under subsection 7b7 for a purpose other than a purpose referred to in paragraph 7#a74 7#c7 ,anti-tasking restriction ,nothing in this section shall be construed to permit the ,federal ,government to-- 7,a7 require a private-sector entity or utility to share information with the ,federal ,government2 or 7,b7 condition the sharing of cyber threat intelligence with a private-sector entity or utility on the provision of cyber threat information to the ,federal ,government4 7#d7 ,protection of sensitive personal documents ,the ,federal ,government may not use the following information1 containing information that identifies a person1 shared with the ,federal ,government in accordance with subsection 7b73 7,a7 ,library circulation records4 7,b7 ,library patron lists4 7,c7 ,book sales records4 7,d7 ,book customer lists4 7,e7 ,firearms sales records4 7,f7 ,tax return records4 7,g7 ,educational records4 7,h7 ,medical records4 7#e7 ,notification of non-cyber threat information ,if a department or agency of the ,federal ,government receiving information pursuant to subsection 7b77#a7 determines that such information is not cyber threat information1 such department or agency shall notify the entity or provider sharing such information pursuant to subsection 7b77#a74 7#f7 ,retention and use of cyber threat information ,no department or agency of the ,federal ,government shall retain or use information shared pursuant to subsection 7b77#a7 for any use other than a use permitted under subsection 7c77#a74 7d7 ,federal ,government liability for violations of restrictions on the disclosure1 use1 and protection of voluntarily shared information 7#a7 ,in general ,if a department or agency of the ,federal ,government intentionally or willfully violates subsection 7b77#c77;,d7 or subsection 7c7 with respect to the disclosure1 use1 or protection of voluntarily shared cyber threat information shared under this section1 the ,united ,states shall be liable to a person adversely affected by such violation in an amount equal to the sum of-- 7,a7 the actual damages sustained by the person as a result of the violation or #a1jjj1 whichever is greater2 and 7,b7 the costs of the action together with reasonable attorney fees as determined by the court4 7#b7 ,venue ,an action to enforce liability created under this subsection may be brought in the district court of the ,united ,states in-- 7,a7 the district in which the complainant resides2 7,b7 the district in which the principal place of business of the complainant is located2 7,c7 the district in which the department or agency of the ,federal ,government that disclosed the information is located2 or 7,d7 the ,district of ,columbia4 7#c7 ,statute of limitations ,no action shall lie under this subsection unless such action is commenced not later than two years after the date of the violation of subsection 7b77#c77;,d7 or subsection 7c7 that is the basis for the action4 7#d7 ,exclusive cause of action ,a cause of action under this subsection shall be the exclusive means available to a complainant seeking a remedy for a violation of subsection 7b77#c77;,d7 or subsection 7c74 7e7 ,federal preemption ,this section supersedes any statute of a ,state or political subdivision of a ,state that restricts or otherwise expressly regulates an activity authorized under subsection 7b74 7f7 ,savings clauses 7#a7 ,existing authorities ,nothing in this section shall be construed to limit any other authority to use a cybersecurity system or to identify1 obtain1 or share cyber threat intelligence or cyber threat information4 7#b7 ,limitation on military and intelligence community involvement in private and public sector cybersecurity efforts ,nothing in this section shall be construed to provide additional authority to1 or modify an existing authority of1 the ,department of ,defense or the ,national ,security ,agency or any other element of the intelligence community to control1 modify1 require1 or otherwise direct the cybersecurity efforts of a private-sector entity or a component of the ,federal ,government or a ,state1 local1 or tribal government4 7#c7 ,information sharing relationships ,nothing in this section shall be construed to-- 7,a7 limit or modify an existing information sharing relationship2 7,b7 prohibit a new information sharing relationship2 7,c7 require a new information sharing relationship between the ,federal ,government and a private-sector entity or utility2 7,d7 modify the authority of a department or agency of the ,federal ,government to protect sources and methods and the national security of the ,united ,states2 or 7,e7 preclude the ,federal ,government from requiring an entity to report significant cyber incidents if authorized or required to do so under another provision of law4 7#d7 ,limitation on ,federal ,government use of cybersecurity systems ,nothing in this section shall be construed to provide additional authority to1 or modify an existing authority of1 any entity to use a cybersecurity system owned or controlled by the ,federal ,government on a private-sector system or network to protect such private-sector system or network4 7#e7 ,no liability for non-participation ,nothing in this section shall be construed to subject a protected entity1 self-protected entity1 cyber security provider1 or an officer1 employee1 or agent of a protected entity1 self-protected entity1 or cybersecurity provider1 to liability for choosing not to engage in the voluntary activities authorized under this section4 7#f7 ,use and retention of information ,nothing in this section shall be construed to authorize1 or to modify any existing authority of1 a department or agency of the ,federal ,government to retain or use information shared pursuant to subsection 7b77#a7 for any use other than a use permitted under subsection 7c77#a74 7#g7 ,limitation on surveillance ,nothing in this section shall be construed to authorize the ,department of ,defense or the ,national ,security ,agency or any other element of the intelligence community to target a ,united ,states person for surveillance4 7g7 ,definitions ,in this section3 7#a7 ,availability ,the term availability means ensuring timely and reliable access to and use of information4 7#b7 ,certified entity ,the term certified entity means a protected entity1 self-protected entity1 or cybersecurity provider that-- 7,a7 possesses or is eligible to obtain a security clearance1 as determined by the ,director of ,national ,intelligence2 and 7,b7 is able to demonstrate to the ,director of ,national ,intelligence that such provider or such entity can appropriately protect classified cyber threat intelligence4 7#c7 ,confidentiality ,the term confidentiality means preserving authorized restrictions on access and disclosure1 including means for protecting personal privacy and proprietary information4 7#d7 ,cyber threat information 7,a7 ,in ,general ,the term cyber threat information means information directly pertaining to-- 7i7 a vulnerability of a system or network of a government or private entity or utility2 7ii7 a threat to the integrity1 confidentiality1 or availability of a system or network of a government or private entity or utility or any information stored on1 processed on1 or transiting such a system or network2 7iii7 efforts to deny access to or degrade1 disrupt1 or destroy a system or network of a government or private entity or utility2 or 7iv7 efforts to gain unauthorized access to a system or network of a government or private entity or utility1 including to gain such unauthorized access for the purpose of exfiltrating information stored on1 processed on1 or transiting a system or network of a government or private entity or utility4 7,b7 ,exclusion ,such term does not include information pertaining to efforts to gain unauthorized access to a system or network of a government or private entity or utility that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access4 7#e7 ,cyber threat intelligence 7,a7 ,in general ,the term cyber threat intelligence means intelligence in the possession of an element of the intelligence community directly pertaining to-- 7i7 a vulnerability of a system or network of a government or private entity or utility2 7ii7 a threat to the integrity1 confidentiality1 or availability of a system or network of a government or private entity or utility or any information stored on1 processed on1 or transiting such a system or network2 7iii7 efforts to deny access to or degrade1 disrupt1 or destroy a system or network of a government or private entity or utility2 or 7iv7 efforts to gain unauthorized access to a system or network of a government or private entity or utility1 including to gain such unauthorized access for the purpose of exfiltrating information stored on1 processed on1 or transiting a system or network of a government or private entity or utility4 7,b7 ,exclusion ,such term does not include intelligence pertaining to efforts to gain unauthorized access to a system or network of a government or private entity or utility that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access4 7#f7 ,cybersecurity crime ,the term cybersecurity crime means-- 7,a7 a crime under a ,federal or ,state law that involves-- 7i7 efforts to deny access to or degrade1 disrupt1 or destroy a system or network2 7ii7 efforts to gain unauthorized access to a system or network2 or 7iii7 efforts to exfiltrate information from a system or network without authorization2 or 7,b7 the violation of a provision of ,federal law relating to computer crimes1 including a violation of any provision of title #ah1 ,united ,states ,code1 created or amended by the ,computer ,fraud and ,abuse ,act of #aihf 7,public ,law #ii-dgd74 7#g7 ,cybersecurity provider ,the term cybersecurity provider means a non-,federal entity that provides goods or services intended to be used for cybersecurity purposes4 7#h7 ,cybersecurity purpose 7,a7 ,in general ,the term cybersecurity purpose means the purpose of ensuring the integrity1 confidentiality1 or availability of1 or safeguarding1 a system or network1 including protecting a system or network from-- 7i7 a vulnerability of a system or network2 7ii7 a threat to the integrity1 confidentiality1 or availability of a system or network or any information stored on1 processed on1 or transiting such a system or network2 7iii7 efforts to deny access to or degrade1 disrupt1 or destroy a system or network2 or 7iv7 efforts to gain unauthorized access to a system or network1 including to gain such unauthorized access for the purpose of exfiltrating information stored on1 processed on1 or transiting a system or network4 7,b7 ,exclusion ,such term does not include the purpose of protecting a system or network from efforts to gain unauthorized access to such system or network that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access4 7#i7 ,cybersecurity system 7,a7 ,in general ,the term cybersecurity system means a system designed or employed to ensure the integrity1 confidentiality1 or availability of1 or safeguard1 a system or network1 including protecting a system or network from-- 7i7 a vulnerability of a system or network2 7ii7 a threat to the integrity1 confidentiality1 or availability of a system or network or any information stored on1 processed on1 or transiting such a system or network2 7iii7 efforts to deny access to or degrade1 disrupt1 or destroy a system or network2 or 7iv7 efforts to gain unauthorized access to a system or network1 including to gain such unauthorized access for the purpose of exfiltrating information stored on1 processed on1 or transiting a system or network4 7,b7 ,exclusion ,such term does not include a system designed or employed to protect a system or network from efforts to gain unauthorized access to such system or network that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access4 7#aj7 ,integrity ,the term integrity means guarding against improper information modification or destruction1 including ensuring information nonrepudiation and authenticity4 7#aa7 ,protected entity ,the term protected entity means an entity1 other than an individual1 that contracts with a cybersecurity provider for goods or services to be used for cybersecurity purposes4 7#ab7 ,self-protected entity ,the term self-protected entity means an entity1 other than an individual1 that provides goods or services for cybersecurity purposes to itself4 7#ac7 ,utility ,the term utility means an entity providing essential services 7other than law enforcement or regulatory services71 including electricity1 natural gas1 propane1 telecommunications1 transportation1 water1 or wastewater services4 4 7b7 ,procedures and guidelines ,the ,director of ,national ,intelligence shall-- 7#a7 not later than #fj days after the date of the enactment of this ,act1 establish procedures under paragraph 7#a7 of section #aajd7;a7 of the ,national ,security ,act of #aidg1 as added by subsection 7a7 of this section1 and issue guidelines under paragraph 7#c7 of such section #aajd7;a72 7#b7 in establishing such procedures and issuing such guidelines1 consult with the ,secretary of ,homeland ,security to ensure that such procedures and such guidelines permit the owners and operators of critical infrastructure to receive all appropriate cyber threat intelligence 7as defined in section #aajd7;h77#e7 of such ,act1 as added by subsection 7a77 in the possession of the ,federal ,government2 and 7#c7 following the establishment of such procedures and the issuance of such guidelines1 expeditiously distribute such procedures and such guidelines to appropriate departments and agencies of the ,federal ,government1 private-sector entities1 and utilities 7as defined in section #aajd7;h77#ac7 of such ,act1 as added by subsection 7a774 7c7 ,privacy and civil liberties policies and procedures ,not later than #fj days after the date of the enactment of this ,act1 the ,director of ,national ,intelligence1 in consultation with the ,secretary of ,homeland ,security and the ,attorney ,general1 shall establish the policies and procedures required under section #aajd7;c77#g77;,a7 of the ,national ,security ,act of #aidg1 as added by subsection 7a7 of this section4 7d7 ,initial reports ,the first reports required to be submitted under paragraphs 7#a7 and 7#b7 of subsection 7e7 of section #aajd of the ,national ,security ,act of #aidg1 as added by subsection 7a7 of this section1 shall be submitted not later than #a year after the date of the enactment of this ,act4 7e7 ,table of contents amendment ,the table of contents in the first section of the ,national ,security ,act of #aidg is amended by adding at the end the following new item3 ,sec4 #aajd4 ,cyber threat intelligence and information sharing4 4 #d4 ,sunset ,effective on the date that is #e years after the date of the enactment of this ,act-- 7#a7 section #aajd of the ,national ,security ,act of #aidg1 as added by section #b7;a7 of this ,act1 is repealed2 and 7#b7 the table of contents in the first section of the ,national ,security ,act of #aidg1 as amended by section #b7;d7 of this ,act1 is amended by striking the item relating to section #aajd1 as added by such section #b7;d74 #e4 ,sense of ,congress on international cooperation ,it is the sense of ,congress that international cooperation with regard to cybersecurity should be encouraged wherever possible under this ,act and the amendments made by this ,act4 #f4 ,rule of construction relating to consumer data ,nothing in this ,act or the amendments made by this ,act shall be construed to provide new or alter any existing authority for an entity to sell personal information of a consumer to another entity for marketing purposes4 #g4 ,savings clause with regard to cybersecurity provider obligation to report cyber threat incident information to ,federal ,government ,nothing in this ,act or the amendments made by this ,act shall be construed to provide authority to a department or agency of the ,federal ,government to require a cybersecurity provider that has contracted with the ,federal ,government to provide information services to provide information about cybersecurity incidents that do not pose a threat to the ,federal ,government's information4 ,passed the ,house of ,representatives ,april #ah1 #bjac4;,clerk4