,i #aadth ,,congress #ast ,session ,h4 ,r4 #cdjb ,,in ,,the ,,house ,,of ,,representatives ,july #bi1 #bjae ,mr4 ,ruppersberger introduced the following bill2 which was referred to the ,committee on ,oversight and ,government ,reform ,a ,,bill ,to strengthen the ability of the ,secretary of ,homeland ,security to detect and prevent intrusions against1 and to use countermeasures to protect1 government agency information systems and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,information ,security ,management ,reform ,act of #bjae4 #b4 ,duties of the ,secretary of ,homeland ,security related to information security ,section #ceec7;b77#f7 of title #dd1 ,united ,states ,code1 is amended by striking subparagraphs 7,b71 7,c71 and 7,d7 and inserting the following3 7,b7 operating consolidated intrusion detection1 prevention1 or other protective capabilities and use of associated countermeasures for the purpose of protecting agency information and information systems from information security threats2 7,c7 providing incident detection1 analysis1 mitigation1 and response information and remote or onsite technical assistance to the head of an agency2 7,d7 compiling and analyzing data on agency information security2 7,e7 developing and conducting targeted risk assessments and operational evaluations for agency information and information systems in consultation with the heads of other agencies or governmental and private entities that own and operate such systems1 that may include threat1 vulnerability1 and impact assessments2 7,f7 in conjunction with other agencies and the private sector1 assessing and fostering the development of information security technologies and capabilities for use across multiple agencies2 and 7,g7 coordinating with appropriate agencies and officials to ensure1 to the maximum extent feasible1 that policies and directives issued under paragraph 7#b7 are complementary with-- 7i7 standards and guidelines developed for national security systems2 and 7ii7 policies and directives issued by the ,secretary of ,defense and the ,director of ,national ,intelligence under subsection 7e77#a72 and 4 #c4 ,communications and system traffic and direction to agencies ,section #ceec of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 7h7 ,communications and systems traffic 7#a7 ,in general 7,a7 ,acquisition by the ,secretary ,notwithstanding any other provision of law and subject to subparagraph 7,b71 in carrying out the responsibilities under subparagraphs 7,b71 7,c71 and 7,e7 of subsection 7b77#f71 if the ,secretary makes a certification described in paragraph 7#b71 the ,secretary may acquire1 intercept1 retain1 use1 and disclose communications and other system traffic that are transiting to or from or stored on agency information systems and deploy countermeasures with regard to the communications and system traffic4 7,b7 ,exception ,the authorities of the ,secretary under this subsection shall not apply to a communication or other system traffic that is transiting to or from or stored on a system described in paragraph 7#b7 or 7#c7 of subsection 7e74 7,c7 ,disclosure by ,federal agency heads ,the head of a ,federal agency or department is authorized to disclose to the ,secretary or a private entity providing assistance to the ,secretary under paragraph 7,a71 information traveling to or from or stored on an agency information system1 notwithstanding any other law that would otherwise restrict or prevent agency heads from disclosing such information to the ,secretary4 7#b7 ,certification ,a certification described in this paragraph is a certification by the ,secretary that-- 7,a7 the acquisitions1 interceptions1 and other countermeasures are reasonably necessary for the purpose of protecting agency information systems from information security threats2 7,b7 the content of communications will be retained only if the communication is associated with a known or reasonably suspected information security threat1 and communications and system traffic will not be subject to the operation of a countermeasure unless associated with the threats2 7,c7 information obtained under activities authorized under this subsection will only be retained1 used1 or disclosed to protect agency information systems from information security threats1 mitigate against such threats1 or1 with the approval of the ,attorney ,general1 for law enforcement purposes when the information is evidence of a crime which has been1 is being1 or is about to be committed2 7,d7 notice has been provided to users of agency information systems concerning the potential for acquisition1 interception1 retention1 use1 and disclosure of communications and other system traffic2 and 7,e7 the activities are implemented pursuant to policies and procedures governing the acquisition1 interception1 retention1 use1 and disclosure of communications and other system traffic that have been reviewed and approved by the ,attorney ,general4 7#c7 ,private entities ,the ,secretary may enter into contracts or other agreements1 or otherwise request and obtain the assistance of1 private entities that provide electronic communication or information security services to acquire1 intercept1 retain1 use1 and disclose communications and other system traffic in accordance with this subsection4 7#d7 ,no cause of action ,no cause of action shall exist against a private entity for assistance provided to the ,secretary in accordance with paragraph 7#c74 7i7 ,direction to agencies 7#a7 ,authority 7,a7 ,in general ,notwithstanding section #ceed1 and subject to subparagraph 7,b71 in response to a known or reasonably suspected information security threat1 vulnerability1 or incident that represents a substantial threat to the information security of an agency1 the ,secretary may issue a directive to the head of an agency to take any lawful action with respect to the operation of the information system1 including such systems owned or operated by another entity on behalf of an agency1 that collects1 processes1 stores1 transmits1 disseminates1 or otherwise maintains agency information1 for the purpose of protecting the information system from1 or mitigating1 an information security threat4 7,b7 ,exception ,the authorities of the ,secretary under this subsection shall not apply to a system described in paragraph 7#b7 or 7#c7 of subsection 7e74 7#b7 ,procedures for use of authority ,the ,secretary shall-- 7,a7 in coordination with the ,director and in consultation with ,federal contractors1 as appropriate1 establish procedures governing the circumstances under which a directive may be issued under this subsection1 which shall include-- 7i7 thresholds and other criteria2 7ii7 privacy and civil liberties protections2 and 7iii7 providing notice to potentially affected third parties2 7,b7 specify the reasons for the required action and the duration of the directive2 7,c7 minimize the impact of a directive under this subsection by-- 7i7 adopting the least intrusive means possible under the circumstances to secure the agency information systems2 and 7ii7 limiting directives to the shortest period practicable2 and 7,d7 notify the ,director and the head of any affected agency immediately upon the issuance of a directive under this subsection4 7#c7 ,imminent threats 7,a7 ,in general ,if the ,secretary determines that there is an imminent threat to agency information systems and a directive under this subsection is not reasonably likely to result in a timely response to the threat1 the ,secretary may authorize the use of protective capabilities under the control of the ,secretary for communications or other system traffic transiting to or from or stored on an agency information system without prior consultation with the affected agency for the purpose of ensuring the security of the information or information system or other agency information systems4 7,b7 ,limitation on delegation ,the authority under this paragraph may not be delegated to an official in a position lower than an ,assistant ,secretary of the ,department of ,homeland ,security4 7,c7 ,notice ,the ,secretary shall immediately notify the ,director and the head and chief information officer 7or equivalent official7 of each affected agency of-- 7i7 any action taken under this subsection2 and 7ii7 the reasons for and duration and nature of the action4 7,d7 ,other law ,any action of the ,secretary under this paragraph shall be consistent with applicable law4 7#d7 ,limitation ,the ,secretary may direct or authorize lawful action or protective capability under this subsection only to-- 7,a7 protect agency information from unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction2 or 7,b7 require the remediation of or protect against identified information security risks with respect to-- 7i7 information collected or maintained by or on behalf of an agency2 or 7ii7 that portion of an information system used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency4 4 #d4 ,report to ,congress regarding office of management and budget enforcement action ,section #ceec of title #dd1 ,united ,states ,code1 as amended by section #c1 is further amended by inserting the following at the end the following new subsection3 7j7 ,annual report to ,congress 7#a7 ,requirement ,not later than ,february #a of every year1 the ,director shall report to the appropriate congressional committee regarding the specific actions the ,director has taken pursuant to subsection 7a77#e71 including any actions taken pursuant to paragraph 7#e7 of title #dj section #aacjc7;b74 7#b7 ,appropriate congressional committee ,in this subsection1 the term appropriate congressional committee means-- 7,a7 the ,committee on ,appropriations and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7,b7 the ,committee on ,appropriations and the ,committee on ,homeland ,security ,committee of the ,house of ,representatives4 4