,,ii #aacth ,,congress #ast ,session ,s4 #afch ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,october #ca1 #bjac,mr4 ,whitehouse 7for himself1 ,mr4 ,blunt1 ,mr4 ,graham1 and ,mr4 ,blumenthal7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to promote public awareness of cybersecurity4 #a4 ,short title ,this ,act may be cited as the ,cybersecurity ,public ,awareness ,act of #bjac4 #b4 ,findings 7a7 ,congress finds the following3 7#a7 ,information technology is central to the effectiveness1 efficiency1 and reliability of industrial and commercial services1 ,armed ,forces and national security systems1 and the critical infrastructure of the ,united ,states4 7#b7 ,cyber criminals1 terrorists1 and agents of foreign powers have taken advantage of the connectivity of the ,united ,states to inflict substantial damage to the economic and national security interests of the ,nation4 7#c7 ,the cyber threat is sophisticated1 relentless1 and massive1 exposing consumers in the ,united ,states to the risk of substantial harm4 7#d7 ,businesses in the ,united ,states are bearing substantial losses as a result of criminal cyber attacks1 depriving businesses of hard-earned profits that could be reinvested in further job-producing innovation4 7#e7 ,hackers continuously probe the networks of ,federal and ,state agencies1 the ,armed ,forces1 and the commercial industrial base of the ,armed ,forces1 and already have caused substantial damage and compromised sensitive and classified information4 7#f7 ,severe cyber threats will continue1 and will likely grow1 as the economy of the ,united ,states grows more connected1 criminals become increasingly sophisticated in efforts to steal from consumers1 industries1 and businesses in the ,united ,states1 and terrorists and foreign nations continue to use cyberspace as a means of attack against the national and economic security of the ,united ,states4 7#g7 ,public awareness of cyber threats is essential to cybersecurity4 ,only a well-informed public and ,congress can make the decisions necessary to protect consumers1 industries1 and the national and economic security of the ,united ,states4 7#h7 ,as of #bjac1 the level of public awareness of cyber threats is unacceptably low4 ,only a tiny portion of relevant cybersecurity information is released to the public4 ,information about attacks on ,federal ,government systems is usually classified4 ,information about attacks on private systems is ordinarily kept confidential4 ,sufficient mechanisms do not exist to provide meaningful threat reports to the public in unclassified and anonymized form4 #c4 ,cyber incidents against government networks 7a7 ,department of ,homeland ,security ,not later than #ahj days after the date of enactment of this ,act1 and annually thereafter1 the ,secretary of ,homeland ,security shall submit to ,congress a report that-- 7#a7 summarizes major cyber incidents involving networks of executive agencies 7as defined in section #aje of title #e1 ,united ,states ,code71 except for the ,department of ,defense2 7#b7 provides aggregate statistics on the number of breaches of networks of executive agencies1 the volume of data exfiltrated1 and the estimated cost of remedying the breaches2 and 7#c7 discusses the risk of cyber sabotage4 7b7 ,department of ,defense ,not later than #ahj days after the date of enactment of this ,act1 and annually thereafter1 the ,secretary of ,defense shall submit to ,congress a report that-- 7#a7 summarizes major cyber incidents against networks of the ,department of ,defense and the military departments2 7#b7 provides aggregate statistics on the number of breaches against networks of the ,department of ,defense and the military departments1 the volume of data exfiltrated1 and the estimated cost of remedying the breaches2 and 7#c7 discusses the risk of cyber sabotage4 7c7 ,form of reports ,each report submitted under this section shall be in unclassified form1 but may include a classified annex as necessary to protect sources1 methods1 and national security4 #d4 ,prosecution for cybercrime 7a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,attorney ,general and the ,director of the ,federal ,bureau of ,investigation shall submit to ,congress reports-- 7#a7 describing investigations and prosecutions by the ,department of ,justice relating to cyber intrusions1 computer or network compromise1 or other forms of illegal hacking the preceding year1 including-- 7,a7 the number of investigations initiated relating to such crimes2 7,b7 the number of arrests relating to such crimes2 7,c7 the number and description of instances in which investigations or prosecutions relating to such crimes have been delayed or prevented because of an inability to extradite a criminal defendant in a timely manner2 and 7,d7 the number of prosecutions for such crimes1 including-- 7i7 the number of defendants prosecuted2 7ii7 whether the prosecutions resulted in a conviction2 7iii7 the sentence imposed and the statutory maximum for each such crime for which a defendant was convicted2 and 7iv7 the average sentence imposed for a conviction of such crimes2 7#b7 identifying the number of employees1 financial resources1 and other resources 7such as technology and training7 devoted to the enforcement1 investigation1 and prosecution of cyber intrusions1 computer or network compromised1 or other forms of illegal hacking1 including the number of investigators1 prosecutors1 and forensic specialists dedicated to investigating and prosecuting cyber intrusions1 computer or network compromise1 or other forms of illegal hacking2 and 7#c7 discussing any impediments under the laws of the ,united ,states or international law to prosecutions for cyber intrusions1 computer or network compromise1 or other forms of illegal hacking4 7b7 ,updates ,the ,attorney ,general and the ,director of the ,federal ,bureau of ,investigation shall annually submit to ,congress reports updating the reports submitted under section 7a7 at the same time the ,attorney ,general and ,director submit annual reports under section #djd of the ,prioritizing ,resources and ,organization for ,intellectual ,property ,act of #bjjh 7#db ,u4,s4,c4 #cgac;d74 #e4 ,response to requests for assistance in private sector cyber incidents 7a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 and annually thereafter1 the ,secretary of ,homeland ,security shall submit to ,congress a report that describes policies and procedures through which ,federal agencies1 upon request from a private sector entity1 assist in the defense of the information networks of the requesting private sector entity against cyber threats that could result in loss of life or significant harm to the national economy or national security4 7b7 ,form of reports ,each report submitted under this section shall be in unclassified form1 but may include a classified annex as necessary to protect sources1 methods1 proprietary or sensitive business information1 and national security4 #f4 ,reporting to shareholders of cyber risks and cyber incidents 7a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 and annually thereafter for #c years1 the ,securities and ,exchange ,commission1 in consultation with the ,secretary of ,commerce and the ,secretary of ,homeland ,security1 shall submit to ,congress a report-- 7#a7 assessing the reporting of cyber risk or cyber incidents in financial statements by issuers of securities2 and 7#b7 evaluating relevant ,commission actions1 including the staff guidance issued by the ,commission on ,october #ac1 #bjaa4 7b7 ,prohibition ,a report submitted under this section shall not include proprietary or sensitive business information or identify any individual issuer4 #g4 ,regulators of critical infrastructure 7a7 ,definitions ,in this section-- 7#a7 the term critical infrastructure sector means any sector identified in ,presidential ,policy ,directive-#ba1 issued ,february #ab1 #bjac 7or any successor thereto72 and 7#b7 the term relevant agencies means-- 7,a7 the sector-specific agencies identified in ,presidential ,policy ,directive-#ba1 issued ,february #ab1 #bjac 7or any successor thereto72 and 7,b7 each agency 7as defined in section #cejb7a7 of title #dd1 ,united ,states ,code7 that has substantial regulatory authority in a critical infrastructure sector4 7b7 ,reports ,not later than #ahj days after the date of enactment of this ,act1 and annually thereafter for #c years1 the ,secretary of ,homeland ,security1 in consultation with relevant agencies1 shall submit to ,congress a report that describes the-- 7#a7 nature and state of the vulnerabilities to cyber threats of each critical infrastructure sector2 7#b7 prevalence and seriousness of cyber threats in each critical infrastructure sector2 7#c7 recommended steps to thwart or diminish cyber threats2 and 7#d7 the degree to which cybersecurity and information assurance cooperative activities with private sector partners developed by the ,department of ,defense and its defense industrial base have been employed in each critical infrastructure sector4 7c7 ,form of reports ,each report submitted under this section-- 7#a7 shall be in unclassified form2 7#b7 shall not-- 7,a7 identify any individual private sector entity2 and 7,b7 include proprietary or sensitive business information2 and 7#c7 may include a classified annex as necessary to protect sources1 methods1 and national security4 #h4 ,research report on developing technologies that would enhance cybersecurity of critical infrastructure entities 7a7 ,definition ,in this section1 the term critical infrastructure has the meaning given that term in section #ajaf7;e7 of the ,,usa ,,patriot ,act 7#db ,u4,s4,c4 #eaie;c7e774 7b7 ,reports 7#a7 ,in general ,the ,secretary of ,homeland ,security shall enter into a contract with the ,national ,research ,council1 or another federally funded research and development corporation1 under which the ,council or corporation shall submit to ,congress a report on opportunities to develop new technologies or technological approaches1 including developing a secure domain1 that would enhance the cybersecurity of critical infrastructure entities4 7#b7 ,limitations ,the report required under paragraph 7#a7 shall-- 7,a7 consider only technologies or technological options that can be deployed consistent with constitutional and statutory privacy rights2 and 7,b7 identify any technologies or technological options described in subparagraph 7,a7 that merit ,federal research support4 7#c7 ,timing ,the contract entered into under paragraph 7#a7 shall require that the report described in paragraph 7#a7 be submitted not later than #a year after the date of enactment of this ,act4 ,the ,secretary of ,homeland ,security may enter into additional subsequent contracts as appropriate4 #i4 ,preparedness of ,federal courts to promote cybersecurity ,not later than #ahj days after the date of enactment of this ,act1 the ,attorney ,general1 in coordination with the ,administrative ,office of the ,united ,states ,courts1 shall submit to ,congress a report-- 7#a7 on whether ,federal courts have granted timely relief in matters relating to botnets and other cybercrime and cyber threats2 and 7#b7 that includes1 as appropriate1 recommendations on changes or improvements to-- 7,a7 the ,federal ,rules of ,civil ,procedure or the ,federal ,rules of ,criminal ,procedure2 7,b7 the training and other resources available to support the ,federal judiciary2 7,c7 the capabilities and specialization of courts to which such cases may be assigned2 and 7,d7 ,federal civil and criminal laws4 #aj4 ,impediments to public awareness ,not later than #ahj days after the date of enactment of this ,act1 and annually thereafter for #c years 7or more frequently if determined appropriate by the ,secretary of ,homeland ,security7 the ,secretary of ,homeland ,security shall submit to ,congress a report on-- 7#a7 legal or other impediments to appropriate public awareness of-- 7,a7 the nature of1 methods of propagation of1 and damage caused by common cyber security threats such as computer viruses1 social engineering techniques1 and malware2 7,b7 the minimal standards of computer security necessary for responsible internet use2 and 7,c7 the availability of commercial off-the-shelf technology that allows consumers to meet such levels of computer security2 7#b7 a summary of the plans of the ,secretary of ,homeland ,security to enhance public awareness of common cyber threats1 including a description of the metrics used by the ,department of ,homeland ,security for evaluating the efficacy of public awareness campaigns2 and 7#c7 recommendations for congressional actions to address these impediments to appropriate public awareness of common cyber threats4