,,ii ,calendar ,no4 #dfb #aacth ,,congress #b;d ,session ,s4 #behh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #aj1 #bjad ,mrs4 ,feinstein1 from the ,select ,committee on ,intelligence1 reported the following original bill2 which was read twice and placed on the calendar ,a ,,bill ,to improve cybersecurity in the ,united ,states through enhanced sharing of information about cybersecurity threats1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,cybersecurity ,information ,sharing ,act of #bjad4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,sec4 #b4 ,definitions4 ,sec4 #c4 ,sharing of information by the ,federal ,government4 ,sec4 #d4 ,authorizations for preventing1 detecting1 analyzing1 and mitigating cybersecurity threats4 ,sec4 #e4 ,sharing of cyber threat indicators and countermeasures with the ,federal ,government4 ,sec4 #f4 ,protection from liability4 ,sec4 #g4 ,oversight of ,government activities4 ,sec4 #h4 ,construction and preemption4 ,sec4 #i4 ,report on cybersecurity threats4 ,sec4 #aj4 ,conforming amendments4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#b7 ,antitrust laws ,the term antitrust laws-- 7,a7 has the meaning given the term in section #a7;a7 of the ,clayton ,act 7#ae ,u4,s4,c4 #ab7;a772 7,b7 includes section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 to the extent that section #e of that ,act applies to unfair methods of competition2 and 7,c7 includes any ,state law that has the same intent and effect as the laws under subparagraphs 7,a7 and 7,b74 7#c7 ,appropriate ,federal entities ,the term appropriate ,federal entities means the following3 7,a7 ,the ,department of ,commerce4 7,b7 ,the ,department of ,defense4 7,c7 ,the ,department of ,energy4 7,d7 ,the ,department of ,homeland ,security4 7,e7 ,the ,department of ,justice4 7,f7 ,the ,department of the ,treasury4 7,g7 ,the ,office of the ,director of ,national ,intelligence4 7#d7 ,countermeasure ,the term countermeasure means an action1 device1 procedure1 technique1 or other measure applied to an information system or information that is stored on1 processed by1 or transiting an information system that prevents or mitigates a known or suspected cybersecurity threat or security vulnerability4 7#e7 ,cybersecurity purpose ,the term cybersecurity purpose means the purpose of protecting an information system or information that is stored on1 processed by1 or transiting an information system from a cybersecurity threat or security vulnerability4 7#f7 ,cybersecurity threat ,the term cybersecurity threat means an action1 not protected by the ,first ,amendment to the ,constitution of the ,united ,states1 on or through an information system that may result in an unauthorized effort to adversely impact the security1 availability1 confidentiality1 or integrity of an information system or information that is stored on1 processed by1 or transiting an information system4 7#g7 ,cyber threat indicator ,the term cyber threat indicator means information that is necessary to indicate1 describe1 or identify-- 7,a7 malicious reconnaissance1 including anomalous patterns of communications that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat or security vulnerability2 7,b7 a method of defeating a security control or exploitation of a security vulnerability2 7,c7 a security vulnerability2 7,d7 a method of causing a user with legitimate access to an information system or information that is stored on1 processed by1 or transiting an information system to unwittingly enable the defeat of a security control or exploitation of a security vulnerability2 7,e7 malicious cyber command and control2 7,f7 the actual or potential harm caused by an incident1 including information exfiltrated when it is necessary in order to describe a cybersecurity threat2 7,g7 any other attribute of a cybersecurity threat1 if disclosure of such attribute is not otherwise prohibited by law2 or 7,h7 any combination thereof4 7#h7 ,electronic format 7,a7 ,in general ,except as provided in subparagraph 7,b71 the term electronic format means information that is shared through electronic mail1 an interactive form on an ,internet website1 or a real time1 automated process between information systems4 7,b7 ,exclusion ,the term electronic format does not include voice or video communication4 7#i7 ,entity 7,a7 ,in general ,the term entity means any private entity1 non-,federal government agency or department1 or ,state1 tribal1 or local government agency or department 7including a political subdivision1 officer1 employee1 or agent thereof74 7,b7 ,inclusions ,the term entity includes a government agency or department 7including an officer1 employee1 or agent thereof7 of the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 the ,virgin ,islands1 ,guam1 ,american ,samoa1 the ,northern ,mariana ,islands1 and any other territory or possession of the ,united ,states4 7,c7 ,exclusion ,the term entity does not include a foreign power as defined in section #aja7;a7 of the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja74 7#aj7 ,federal entity ,the term ,federal entity means a department or agency of the ,united ,states1 or any component1 officer1 employee1 or agent of such a department or agency4 7#aa7 ,information system ,the term information system-- 7,a7 has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code2 and 7,b7 includes industrial control systems1 such as supervisory control and data acquisition systems1 distributed control systems1 and programmable logic controllers4 7#ab7 ,local government ,the term local government means any borough1 city1 county1 parish1 town1 township1 village1 or other political subdivision of a ,state4 7#ac7 ,malicious cyber command and control ,the term malicious cyber command and control means a method for unauthorized remote identification of1 access to1 or use of1 an information system or information that is stored on1 processed by1 or transiting an information system4 7#ad7 ,malicious reconnaissance ,the term malicious reconnaissance means a method for actively probing or passively monitoring an information system for the purpose of discerning security vulnerabilities of the information system1 if such method is associated with a known or suspected cybersecurity threat4 7#ae7 ,monitor ,the term monitor means to obtain1 identify1 or otherwise possess information that is stored on1 processed by1 or transiting an information system4 7#af7 ,private entity 7,a7 ,in general ,the term private entity means any individual or private group1 organization1 proprietorship1 partnership1 trust1 cooperative1 corporation1 or other commercial or nonprofit entity1 including an officer1 employee1 or agent thereof4 7,b7 ,exclusion ,the term private entity does not include a foreign power as defined in section #aja7;a7 of the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja74 7#ag7 ,security control ,the term security control means the management1 operational1 and technical controls used to protect the confidentiality1 integrity1 and availability of an information system or its information4 7#ah7 ,security vulnerability ,the term security vulnerability means any attribute of hardware1 software1 process1 or procedure that could enable or facilitate the defeat of a security control4 7#ai7 ,tribal ,the term tribal has the meaning given the term ,indian tribe in section #d of the ,indian ,self-,determination and ,education ,assistance ,act 7#be ,u4,s4,c4 #dej;b74 #c4 ,sharing of information by the ,federal ,government 7a7 ,in general ,consistent with the protection of intelligence sources and methods and the protection of privacy and civil liberties1 the ,director of ,national ,intelligence1 the ,secretary of ,homeland ,security1 the ,secretary of ,defense1 and the ,attorney ,general1 in consultation with the heads of the appropriate ,federal entities1 shall develop and promulgate procedures to facilitate and promote-- 7#a7 the timely sharing of classified cyber threat indicators in the possession of the ,federal ,government with cleared representatives of appropriate entities2 7#b7 the timely sharing with appropriate entities of cyber threat indicators or information in the possession of the ,federal ,government that may be declassified and shared at an unclassified level2 and 7#c7 the sharing with appropriate entities1 or1 if appropriate1 public availability1 of unclassified1 including controlled unclassified1 cyber threat indicators in the possession of the ,federal ,government4 7b7 ,development of procedures 7#a7 ,in general ,the procedures developed and promulgated under subsection 7a7 shall-- 7,a7 ensure the ,federal ,government has and maintains the capability to share cyber threat indicators in real time consistent with the protection of classified information2 and 7,b7 incorporate1 to the greatest extent possible1 existing processes and existing roles and responsibilities of ,federal and non-,federal entities for information sharing by the ,federal ,government1 including sector specific information sharing and analysis centers4 7#b7 ,coordination ,in developing the procedures required under this section1 the ,director of ,national ,intelligence1 the ,secretary of ,homeland ,security1 and the ,attorney ,general shall coordinate with appropriate ,federal entities1 including the ,national ,laboratories 7as defined in section #b of the ,energy ,policy ,act of #bjje 7#db ,u4,s4,c4 #aehja771 to ensure that effective protocols are implemented that will facilitate and promote the sharing of cyber threat indicators by the ,federal ,government in a timely manner4 7c7 ,submittal to ,congress ,not later than #fj days after the date of the enactment of this ,act1 the ,director of ,national ,intelligence1 in consultation with the heads of the appropriate ,federal entities1 shall submit to ,congress the procedures required by subsection 7a74 #d4 ,authorizations for preventing1 detecting1 analyzing1 and mitigating cybersecurity threats 7a7 ,authorization for monitoring 7#a7 ,in general ,notwithstanding any other provision of law1 a private entity may1 for cybersecurity purposes1 monitor-- 7,a7 the information systems of such private entity2 7,b7 the information systems of another entity1 upon written consent of such other entity2 7,c7 the information systems of a ,federal entity1 upon written consent of an authorized representative of the ,federal entity2 and 7,d7 information that is stored on1 processed by1 or transiting the information systems monitored by the private entity under this paragraph4 7#b7 ,construction ,nothing in this subsection shall be construed to authorize the monitoring of information systems other than as provided in this subsection or to limit otherwise lawful activity4 7b7 ,authorization for operation of countermeasures 7#a7 ,in general ,notwithstanding any other provision of law1 a private entity may1 for cybersecurity purposes1 operate countermeasures that are applied to-- 7,a7 the information systems of such private entity in order to protect the rights or property of the private entity2 7,b7 the information systems of another entity upon written consent of such entity to protect the rights or property of such entity2 and 7,c7 the information systems of a ,federal entity upon written consent of an authorized representative of such ,federal entity to protect the rights or property of the ,federal ,government4 7#b7 ,construction ,nothing in this subsection shall be construed to authorize the use of countermeasures other than as provided in this subsection or to limit otherwise lawful activity4 7c7 ,authorization for sharing or receiving cyber threat indicators or countermeasures 7#a7 ,in general ,notwithstanding any other provision of law1 and for the purposes permitted under this ,act1 an entity may1 consistent with the protection of classified information1 share with1 or receive from1 any other entity or the ,federal ,government cyber threat indicators and countermeasures4 7#b7 ,construction ,nothing in this subsection shall be construed to authorize the sharing or receiving of cyber threat indicators or countermeasures other than as provided in this subsection or to limit otherwise lawful activity4 7d7 ,protection and use of information 7#a7 ,security of information ,an entity or ,federal entity monitoring information systems1 operating countermeasures1 or providing or receiving cyber threat indicators or countermeasures under this section shall implement and utilize security controls to protect against unauthorized access to or acquisition of such cyber threat indicators or countermeasures4 7#b7 ,removal of certain personal information ,an entity or ,federal entity sharing cyber threat indicators pursuant to this ,act shall1 prior to such sharing1 remove any information contained within such indicators that the entity or ,federal entity knows at the time of sharing to be personal information of or identifying a specific person not directly related to a cybersecurity threat4 7#c7 ,use of cyber threat indicators and countermeasures by entities 7,a7 ,in general ,consistent with this ,act1 cyber threat indicators or countermeasures shared or received under this section may1 for cybersecurity purposes-- 7i7 be used by an entity to monitor or operate countermeasures on its information systems1 or the information systems of another entity or a ,federal entity upon the written consent of that other entity or that ,federal entity2 and 7ii7 be otherwise used1 retained1 and further shared by an entity4 7,b7 ,construction ,nothing in this paragraph shall be construed to authorize the use of cyber threat indicators or countermeasures other than as provided in this section4 7#d7 ,use of cyber threat indicators by ,state1 tribal1 or local departments or agencies 7,a7 ,law enforcement use 7i7 ,prior written consent ,except as provided in clause 7ii71 cyber threat indicators shared with a ,state1 tribal1 or local department or agency under this section may1 with the prior written consent of the entity sharing such indicators1 be used by a ,state1 tribal1 or local department or agency for the purpose of preventing1 investigating1 or prosecuting a computer crime4 7ii7 ,oral consent ,if the need for immediate use prevents obtaining written consent1 such consent may be provided orally with subsequent documentation of the consent4 7,b7 ,exemption from disclosure ,cyber threat indicators shared with a ,state1 tribal1 or local department or agency under this section shall be-- 7i7 deemed voluntarily shared information2 and 7ii7 exempt from disclosure under any ,state1 tribal1 or local law requiring disclosure of information or records4 7,c7 ,state1 tribal1 and local regulatory authority 7i7 ,authorization ,cyber threat indicators shared with a ,state1 tribal1 or local department or agency under this section may1 consistent with ,state regulatory authority specifically relating to the prevention or mitigation of cybersecurity threats to information systems1 inform the development or implementation of regulations relating to such information systems4 7ii7 ,limitation ,such cyber threat indicators shall not otherwise be directly used by any ,state1 tribal1 or local department or agency to regulate the lawful activities of an entity4 7e7 ,antitrust exemption 7#a7 ,in general ,except as provided in section #h7;e71 it shall not be considered a violation of any provision of antitrust laws for two or more private entities to exchange or provide cyber threat indicators1 or assistance relating to the prevention1 investigation1 or mitigation of cybersecurity threats1 for cybersecurity purposes under this ,act4 7#b7 ,applicability ,paragraph 7#a7 shall apply only to information that is exchanged or assistance provided in order to assist with-- 7,a7 facilitating the prevention1 investigation1 or mitigation of cybersecurity threats to information systems or information that is stored on1 processed by1 or transiting an information system2 or 7,b7 communicating or disclosing cyber threat indicators to help prevent1 investigate1 or mitigate the effects of cybersecurity threats to information systems or information that is stored on1 processed by1 or transiting an information system4 7f7 ,no right or benefit ,the sharing of cyber threat indicators with an entity under this ,act shall not create a right or benefit to similar information by such entity or any other entity4 #e4 ,sharing of cyber threat indicators and countermeasures with the ,federal ,government 7a7 ,requirement for policies and procedures 7#a7 ,interim policies and procedures ,not later than #fj days after the date of the enactment of this ,act1 the ,attorney ,general1 in coordination with the heads of the appropriate ,federal entities1 shall develop1 and submit to ,congress1 interim policies and procedures relating to the receipt of cyber threat indicators and countermeasures by the ,federal ,government4 7#b7 ,final policies and procedures ,not later than #ahj days after the date of the enactment of this ,act1 the ,attorney ,general1 in coordination with the heads of the appropriate ,federal entities1 shall promulgate final policies and procedures relating to the receipt of cyber threat indicators and countermeasures by the ,federal ,government4 7#c7 ,requirements concerning policies and procedures ,the policies and procedures developed and promulgated under this subsection shall-- 7,a7 ensure that cyber threat indicators shared with the ,federal ,government by any entity pursuant to section #d1 and that are received through the process described in subsection 7c7-- 7i7 are shared in real time and simultaneous with such receipt with all of the appropriate ,federal entities2 7ii7 are not subject to any delay1 interference1 or any other action that could impede real-time receipt by all of the appropriate ,federal entities2 and 7iii7 may be provided to other ,federal entities2 7,b7 ensure that cyber threat indicators shared with the ,federal ,government by any entity pursuant to section #d in a manner other than the process described in subsection 7c7-- 7i7 are shared immediately with all of the appropriate ,federal entities2 7ii7 are not subject to any unreasonable delay1 interference1 or any other action that could impede receipt by all of the appropriate ,federal entities2 and 7iii7 may be provided to other ,federal entities2 7,c7 govern1 consistent with this ,act1 any other applicable laws1 and the fair information practice principles set forth in appendix ,a of the document entitled ,national ,strategy for ,trusted ,identities in ,cyberspace and published by the ,president in ,april1 #bjaa1 the retention1 use1 and dissemination by the ,federal ,government of cyber threat indicators shared with the ,federal ,government under this ,act1 including the extent1 if any1 to which such cyber threat indicators may be used by the ,federal ,government2 and 7,d7 ensure there is an audit capability and appropriate sanctions in place for officers1 employees1 or agents of a ,federal entity who knowingly and willfully conduct activities under this ,act in an unauthorized manner4 7b7 ,privacy and civil liberties 7#a7 ,guidelines of ,attorney ,general ,the ,attorney ,general shall1 in coordination with the heads of the appropriate ,federal agencies and in consultation with officers designated under section #ajfb of the ,national ,security ,intelligence ,reform ,act of #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a71 develop and periodically review guidelines relating to privacy and civil liberties which shall govern the receipt1 retention1 use1 and dissemination of cyber threat indicators by a ,federal entity obtained in connection with activities authorized in this ,act4 7#b7 ,content ,the guidelines developed and reviewed under paragraph 7#a7 shall1 consistent with the need to protect information systems from cybersecurity threats and mitigate cybersecurity threats-- 7,a7 limit the impact on privacy and civil liberties of activities by the ,federal ,government under this ,act2 7,b7 limit the receipt1 retention1 use1 and dissemination of cyber threat indicators containing personal information of or identifying specific persons1 including establishing-- 7i7 a process for the timely destruction of information that is known not to be directly related to uses authorized under this ,act2 and 7ii7 specific limitations on the length of any period in which a cyber threat indicator may be retained2 7,c7 include requirements to safeguard cyber threat indicators containing personal information of or identifying specific persons from unauthorized access or acquisition1 including appropriate sanctions for activities by officers1 employees1 or agents of the ,federal ,government in contravention of such guidelines2 7,d7 include procedures for notifying entities if information received pursuant to this section is known by a ,federal entity receiving the information not to constitute a cyber threat indicator2 and 7,e7 protect the confidentiality of cyber threat indicators containing personal information of or identifying specific persons to the greatest extent practicable and require recipients to be informed that such indicators may only be used for purposes authorized under this ,act4 7c7 ,capability and process within the ,department of ,homeland ,security 7#a7 ,in general ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary of ,homeland ,security1 in coordination with the heads of the appropriate ,federal entities1 shall develop and implement a capability and process within the ,department of ,homeland ,security that-- 7,a7 shall accept from any entity in real time cyber threat indicators and countermeasures in an electronic format1 pursuant to this section2 7,b7 shall1 upon submittal of the certification under paragraph 7#b7 that such capability and process fully and effectively operates as described in such paragraph1 be the process by which the ,federal ,government receives cyber threat indicators and countermeasures under this ,act in an electronic format that are shared by a private entity with the ,federal ,government except-- 7i7 communications between a ,federal entity and a private entity regarding a previously shared cyber threat indicator2 7ii7 voluntary or legally compelled participation in an open ,federal investigation2 7iii7 information received through an automated malware analysis capability operated by the ,federal ,bureau of ,investigation that is designed to ensure that information received through and analysis produced by such capability is also immediately shared through the capability and process developed by the ,secretary of ,homeland ,security under this paragraph2 7iv7 communications with a ,federal regulatory authority by regulated entities regarding a cybersecurity threat2 and 7v7 cyber threat indicators or countermeasures shared with a ,federal entity as part of a contractual or statutory requirement2 7,c7 ensures that all of the appropriate ,federal entities receive such cyber threat indicators in real time and simultaneous with receipt through the process within the ,department of ,homeland ,security2 and 7,d7 is in compliance with the policies1 procedures1 and guidelines required by this section4 7#b7 ,certification ,not later than #aj days prior to the implementation of the capability and process required by paragraph 7#a71 the ,secretary of ,homeland ,security shall1 in consultation with the heads of the appropriate ,federal entities1 certify to ,congress whether such capability and process fully and effectively operates-- 7,a7 as the process by which the ,federal ,government receives from any entity cyber threat indicators and countermeasures in an electronic format under this ,act2 and 7,b7 in accordance with the policies1 procedures1 and guidelines developed under this section4 7#c7 ,public notice and access ,the ,secretary of ,homeland ,security shall ensure there is public notice of1 and access to1 the capability and process developed and implemented under paragraph 7#a7 so that any entity may share cyber threat indicators and countermeasures through such process with the ,federal ,government and that all of the appropriate ,federal entities receive such cyber threat indicators and countermeasures in real time and simultaneous with receipt through the process within the ,department of ,homeland ,security4 7#d7 ,other ,federal entities ,the process developed and implemented under paragraph 7#a7 shall ensure that other ,federal entities receive in a timely manner any cyber threat indicators and countermeasures shared with the ,federal ,government through the process created in this subsection4 7#e7 ,reports 7,a7 ,report on development and implementation 7i7 ,in general ,not later than #fj days after the date of the enactment of this ,act1 the ,secretary of ,homeland ,security shall submit to ,congress a report on the development and implementation of the capability and process required by paragraph 7#a71 including a description of such capability and process and the public notice of1 and access to1 such process4 7ii7 ,classified annex ,the report required by clause 7i7 shall be submitted in unclassified form1 but may include a classified annex4 7,b7 ,report on automated malware analysis capability ,not later than #a year after the date of the enactment of this ,act1 the ,director of the ,federal ,bureau of ,investigation and the ,secretary of ,homeland ,security shall submit to ,congress a report on the implementation of the automated malware analysis capability described in paragraph 7#a77;,b77iii71 including an assessment of the feasibility and advisability of transferring the administration and operation of such capability to the ,department of ,homeland ,security4 7d7 ,information shared with or provided to the ,federal ,government 7#a7 ,no waiver of privilege or protection ,the provision of cyber threat indicators and countermeasures to the ,federal ,government under this ,act shall not constitute a waiver of any applicable privilege or protection provided by law1 including trade secret protection4 7#b7 ,proprietary information ,a cyber threat indicator or countermeasure provided by an entity to the ,federal ,government under this ,act shall be considered the commercial1 financial1 and proprietary information of such entity when so designated by such entity4 7#c7 ,exemption from disclosure ,cyber threat indicators and countermeasures provided to the ,federal ,government under this ,act shall be-- 7,a7 deemed voluntarily shared information and exempt from disclosure under section #eeb of title #e1 ,united ,states ,code1 and any ,state1 tribal1 or local law requiring disclosure of information or records2 and 7,b7 withheld1 without discretion1 from the public under section #eeb7;b77#c77;,b7 of title #e1 ,united ,states ,code1 and any ,state1 tribal1 or local provision of law requiring disclosure of information or records4 7#d7 ,ex parte communications ,the provision of cyber threat indicators and countermeasures to the ,federal ,government under this ,act shall not be subject to the rules of any ,federal agency or department or any judicial doctrine regarding ex parte communications with a decisionmaking official4 7#e7 ,disclosure1 retention1 and use 7,a7 ,authorized activities ,cyber threat indicators and countermeasures provided to the ,federal ,government under this ,act may be disclosed to1 retained by1 and used by1 consistent with otherwise applicable ,federal law1 any ,federal agency or department1 component1 officer1 employee1 or agent of the ,federal ,government solely for-- 7i7 a cybersecurity purpose2 7ii7 the purpose of responding to1 or otherwise preventing or mitigating1 an imminent threat of death or serious bodily harm2 7iii7 the purpose of responding to1 or otherwise preventing or mitigating1 a serious threat to a minor1 including sexual exploitation and threats to physical safety2 or 7iv7 the purpose of preventing1 investigating1 or prosecuting an offense arising out of a threat described in clause 7ii7 or any of the offenses listed in-- 7,i7 sections #ajbh through #ajcj of title #ah1 ,united ,states ,code 7relating to fraud and identity theft72 7,,ii7 chapter #cg of such title 7relating to espionage and censorship72 and 7,,iii7 chapter #ij of such title 7relating to protection of trade secrets74 7,b7 ,prohibited activities ,cyber threat indicators and countermeasures provided to the ,federal ,government under this ,act shall not be disclosed to1 retained by1 or used by any ,federal agency or department for any use not permitted under subparagraph 7,a74 7,c7 ,privacy and civil liberties ,cyber threat indicators and countermeasures provided to the ,federal ,government under this ,act shall be retained1 used1 and disseminated by the ,federal ,government-- 7i7 in accordance with the policies1 procedures1 and guidelines required by subsections 7a7 and 7b72 7ii7 in a manner that protects from unauthorized use or disclosure any cyber threat indicators that may contain personal information of or identifying specific persons2 and 7iii7 in a manner that protects the confidentiality of cyber threat indicators containing information of1 or that identifies1 a specific person4 7,d7 ,federal regulatory authority 7i7 ,in general ,cyber threat indicators and countermeasures provided to the ,federal ,government under this ,act may1 consistent with ,federal or ,state regulatory authority specifically relating to the prevention or mitigation of cybersecurity threats to information systems1 inform the development or implementation of regulations relating to such information systems4 7ii7 ,limitation ,cyber threat indicators and countermeasures provided to the ,federal ,government under this ,act shall not be directly used by any ,federal1 ,state1 tribal1 or local government department or agency to regulate the lawful activities of an entity1 including activities relating to monitoring1 operation of countermeasures1 or sharing of cyber threat indicators4 7iii7 ,exception ,procedures developed and implemented under this ,act shall not be considered regulations within the meaning of this subparagraph4 #f4 ,protection from liability 7a7 ,monitoring of information systems ,no cause of action shall lie or be maintained in any court against any private entity1 and such action shall be promptly dismissed1 for the monitoring of information systems and information under subsection 7a7 of section #d that is conducted in accordance with this ,act4 7b7 ,sharing or receipt of cyber threat indicators ,no cause of action shall lie or be maintained in any court against any entity1 and such action shall be promptly dismissed1 for the sharing or receipt of cyber threat indicators or countermeasures under subsection 7c7 of section #d if-- 7#a7 such sharing or receipt is conducted in accordance with this ,act2 and 7#b7 in a case in which a cyber threat indicator or countermeasure is shared with the ,federal ,government in an electronic format1 the cyber threat indicator or countermeasure is shared in a manner that is consistent with section #e7;c74 7c7 ,good faith defense in certain causes of action ,if a cause of action is not otherwise dismissed or precluded under subsection 7a7 or 7b71 a good faith reliance by an entity that the conduct complained of was permitted under this ,act shall be a complete defense against any action brought in any court against such entity4 7d7 ,construction ,nothing in this section shall be construed to require dismissal of a cause of action against an entity that has engaged in-- 7#a7 gross negligence or wilful misconduct in the course of conducting activities authorized by this ,act2 or 7#b7 conduct that is otherwise not in compliance with the requirements of this ,act4 #g4 ,oversight of ,government activities 7a7 ,biennial report on implementation 7#a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 and not less frequently than once every #b years thereafter1 the heads of the appropriate ,federal entities shall jointly submit to ,congress a detailed report concerning the implementation of this ,act4 7#b7 ,contents ,each report submitted under paragraph 7#a7 shall include the following3 7,a7 ,an assessment of the sufficiency of the policies1 procedures1 and guidelines required by section #e in ensuring that cyber threat indicators are shared effectively and responsibly within the ,federal ,government4 7,b7 ,an evaluation of the effectiveness of real-time information sharing through the capability and process developed under section #e7;c71 including any impediments to such real-time sharing4 7,c7 ,an assessment of the sufficiency of the procedures developed under section #c in ensuring that cyber threat indicators in the possession of the ,federal ,government are shared in a timely and adequate manner with appropriate entities1 or1 if appropriate1 are made publicly available4 7,d7 ,an assessment of whether cyber threat indicators have been properly classified and an accounting of the number of security clearances authorized by the ,federal ,government for the purposes of this ,act4 7,e7 ,a review of the type of cyber threat indicators shared with the ,federal ,government under this ,act1 including-- 7i7 the degree to which such information may impact the privacy and civil liberties of specific persons2 7ii7 a quantitative and qualitative assessment of the impact of the sharing of such cyber threat indicators with the ,federal ,government on privacy and civil liberties of specific persons2 and 7iii7 the adequacy of any steps taken by the ,federal ,government to reduce such impact4 7,f7 ,a review of actions taken by the ,federal ,government based on cyber threat indicators shared with the ,federal ,government under this ,act1 including the appropriateness of any subsequent use or dissemination of such cyber threat indicators by a ,federal entity under section #e4 7,g7 ,a description of any significant violations of the requirements of this ,act by the ,federal ,government4 7,h7 ,a classified summary of the number and type of entities that received classified cyber threat indicators from the ,federal ,government under this ,act and an evaluation of the risks and benefits of sharing such cyber threat indicators4 7#c7 ,recommendations ,each report submitted under paragraph 7#a7 may include such recommendations as the heads of the appropriate ,federal entities may have for improvements or modifications to the authorities and processes under this ,act4 7#d7 ,form of report ,each report required by paragraph 7#a7 shall be submitted in unclassified form1 but shall include a classified annex4 7b7 ,reports on privacy and civil liberties 7#a7 ,biennial report from ,privacy and ,civil ,liberties ,oversight ,board ,not later than #b years after the date of the enactment of this ,act and not less frequently than once every #b years thereafter1 the ,privacy and ,civil ,liberties ,oversight ,board shall submit to ,congress and the ,president a report providing-- 7,a7 an assessment of the privacy and civil liberties impact of the type of activities carried out under this ,act2 and 7,b7 an assessment of the sufficiency of the policies1 procedures1 and guidelines established pursuant to section #e in addressing privacy and civil liberties concerns4 7#b7 ,biennial report of ,inspectors general 7,a7 ,in general ,not later than #b years after the date of the enactment of this ,act and not less frequently than once every #b years thereafter1 the ,inspector ,general of the ,department of ,homeland ,security1 the ,inspector ,general of the ,intelligence ,community1 the ,inspector ,general of the ,department of ,justice1 and the ,inspector ,general of the ,department of ,defense shall jointly submit to ,congress a report on the receipt1 use1 and dissemination of cyber threat indicators and countermeasures that have been shared with ,federal entities under this ,act4 7,b7 ,contents ,each report submitted under subparagraph 7,a7 shall include the following3 7i7 ,a review of the types of cyber threat indicators shared with ,federal entities4 7ii7 ,a review of the actions taken by ,federal entities as a result of the receipt of such cyber threat indicators4 7iii7 ,a list of ,federal entities receiving such cyber threat indicators4 7iv7 ,a review of the sharing of such cyber threat indicators among ,federal entities to identify inappropriate barriers to sharing information4 7#c7 ,recommendations ,each report submitted under this subsection may include such recommendations as the ,privacy and ,civil ,liberties ,oversight ,board1 with respect to a report submitted under paragraph 7#a71 or the ,inspectors ,general referred to in paragraph 7#b77;,a71 with respect to a report submitted under paragraph 7#b71 may have for improvements or modifications to the authorities under this ,act4 7#d7 ,form ,each report required under this subsection shall be submitted in unclassified form1 but may include a classified annex4 #h4 ,construction and preemption 7a7 ,otherwise lawful disclosures ,nothing in this ,act shall be construed to limit or prohibit otherwise lawful disclosures of communications1 records1 or other information1 including reporting of known or suspected criminal activity1 by an entity to any other entity or the ,federal ,government under this ,act4 7b7 ,whistleblower protections ,nothing in this ,act shall be construed to preempt any employee from exercising rights currently provided under any whistleblower law1 rule1 or regulation4 7c7 ,protection of sources and methods ,nothing in this ,act shall be construed-- 7#a7 as creating any immunity against1 or otherwise affecting1 any action brought by the ,federal ,government1 or any agency or department thereof1 to enforce any law1 executive order1 or procedure governing the appropriate handling1 disclosure1 or use of classified information2 7#b7 to impact the conduct of authorized law enforcement or intelligence activities2 or 7#c7 to modify the authority of a department or agency of the ,federal ,government to protect sources and methods and the national security of the ,united ,states4 7d7 ,relationship to other laws ,nothing in this ,act shall be construed to affect any requirement under any other provision of law for an entity to provide information to the ,federal ,government4 7e7 ,prohibited conduct ,nothing in this ,act shall be construed to permit price-fixing1 allocating a market between competitors1 monopolizing or attempting to monopolize a market1 boycotting1 or exchanges of price or cost information1 customer lists1 or information regarding future competitive planning4 7f7 ,information sharing relationships ,nothing in this ,act shall be construed-- 7#a7 to limit or modify an existing information sharing relationship2 7#b7 to prohibit a new information sharing relationship2 7#c7 to require a new information sharing relationship between any entity and the ,federal ,government2 7#d7 to require the use of the capability and process within the ,department of ,homeland ,security developed under section #e7;c72 or 7#e7 to amend1 repeal1 or supersede any current or future contractual agreement1 terms of service agreement1 or other contractual relationship between any entities1 or between any entity and the ,federal ,government4 7g7 ,anti-tasking restriction ,nothing in this ,act shall be construed to permit the ,federal ,government-- 7#a7 to require an entity to provide information to the ,federal ,government2 or 7#b7 to condition the sharing of cyber threat indicators with an entity on such entity's provision of cyber threat indicators to the ,federal ,government4 7h7 ,no liability for non-participation ,nothing in this ,act shall be construed to subject any entity to liability for choosing not to engage in the voluntary activities authorized in this ,act4 7i7 ,use and retention of information ,nothing in this ,act shall be construed to authorize1 or to modify any existing authority of1 a department or agency of the ,federal ,government to retain or use any information shared under this ,act for any use other than permitted in this ,act4 7j7 ,federal preemption 7#a7 ,in general ,this ,act supersedes any statute or other law of a ,state or political subdivision of a ,state that restricts or otherwise expressly regulates an activity authorized under this ,act4 7#b7 ,state law enforcement ,nothing in this ,act shall be construed to supersede any statute or other law of a ,state or political subdivision of a ,state concerning the use of authorized law enforcement practices and procedures4 7k7 ,regulatory authority ,nothing in this ,act shall be construed-- 7#a7 to authorize the promulgation of any regulations not specifically authorized by this ,act2 7#b7 to establish any regulatory authority not specifically established under ,act2 or 7#c7 to authorize regulatory actions that would duplicate or conflict with regulatory requirements1 mandatory standards1 or related processes under ,federal law4 #i4 ,report on cybersecurity threats 7a7 ,requirement for report ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of ,national ,intelligence1 in coordination with the heads of other appropriate elements of the intelligence community1 shall submit to the ,select ,committee on ,intelligence of the ,senate and the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives a report on cybersecurity threats1 including cyber attacks1 theft1 and data breaches4 ,such report shall include the following3 7#a7 ,an assessment of the current intelligence sharing and cooperation relationships of the ,united ,states with other countries regarding cybersecurity threats1 including cyber attacks1 theft1 and data breaches1 directed against the ,united ,states and which threaten the ,united ,states national security interests and economy and intellectual property1 specifically identifying the relative utility of such relationships1 which elements of the intelligence community participate in such relationships1 and whether and how such relationships could be improved4 7#b7 ,a list and an assessment of the countries and non-state actors that are the primary threats of carrying out a cybersecurity threat1 including a cyber attack1 theft1 or data breach1 against the ,united ,states and which threaten the ,united ,states national security1 economy1 and intellectual property4 7#c7 ,a description of the extent to which the capabilities of the ,united ,states ,government to respond to or prevent cybersecurity threats1 including cyber attacks1 theft1 or data breaches1 directed against the ,united ,states private sector are degraded by a delay in the prompt notification by private entities of such threats or cyber attacks1 theft1 and breaches4 7#d7 ,an assessment of additional technologies or capabilities that would enhance the ability of the ,united ,states to prevent and to respond to cybersecurity threats1 including cyber attacks1 theft1 and data breaches4 7#e7 ,an assessment of any technologies or practices utilized by the private sector that could be rapidly fielded to assist the intelligence community in preventing and responding to cybersecurity threats4 7b7 ,intelligence community defined ,in this section1 the term intelligence community has the meaning given that term in section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d774 7c7 ,form of report ,the report required by subsection 7a7 shall be made available in classified and unclassified forms4 #aj4 ,conforming amendments 7a7 ,public information ,section #eeb7;b7 of title #e1 ,united ,states ,code1 is amended-- 7#a7 in paragraph 7#h71 by striking or at the end2 7#b7 in paragraph 7#i71 by striking wells4 and inserting wells2 or2 and 7#c7 by adding at the end the following3 7#aj7 information shared with or provided to the ,federal ,government pursuant to the ,cybersecurity ,information ,sharing ,act of #bjad4 4 7b7 ,modification of limitation on dissemination of certain information concerning penetrations of defense contractor networks ,section #ida7;c77#c7 of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjac 7,public ,law #aab-bci7 is amended by inserting at the end the following3 ,the ,secretary may share such information with other ,federal entities if such information consists of cyber threat indicators and countermeasures and such information is shared consistent with the policies and procedures promulgated by the ,attorney ,general under section #e of the ,cybersecurity ,information ,sharing ,act of #bjad44 ,july #aj1 #bjad,read twice and placed on the calendar