,,ii #aadth ,,congress #b;d ,session ,s4 #cafj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #ab1 #bjaf ,mr4 ,perdue 7for himself1 ,mr4 ,sasse1 ,mr4 ,isakson1 and ,mr4 ,risch7 introduced the following bill2 which was read twice and referred to the ,committee on ,foreign ,relations ,a ,,bill ,to require all ,department of ,state employees to use ,department-managed email accounts and telephonic systems for all work-related electronic communications1 to require the ,secretary of ,state to submit an annual report to ,congress on any security violations within the ,department1 to provide training to ,department of ,state employees on the rules and procedures governing the appropriate handling of classified information1 to reform the process for identifying and archiving classified information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,securing our ,secrets ,act or the ,,sos ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,foreign ,relations of the ,senate2 7,b7 the ,select ,committee on ,intelligence of the ,senate2 7,c7 the ,committee on ,foreign ,affairs of the ,house of ,representatives2 and 7,d7 the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives4 7#b7 ,department ,the term ,department means the ,department of ,state4 7#c7 ,infraction2 violation ,the terms infraction and violation have the meanings given such terms in section #f4a of ,executive ,order #acebf 7#bjji74 7#d7 ,inspector general ,the term ,inspector ,general means the ,inspector ,general for the ,department of ,state and the ,broadcasting ,board of ,governors4 7#e7 ,intelligence community ,the term intelligence community has the meaning given that term in section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d774 7#f7 ,secretary ,the term ,secretary means the ,secretary of ,state4 #c4 ,use of nongovernmental information systems 7a7 ,in general ,beginning not later than #cj days after the date of the enactment of this ,act1 employees of the ,department may only use1 for all electronic communications related to their work for the ,department-- 7#a7 email accounts on state4gov that are owned and managed by the ,department2 7#b7 telephonic systems that are owned and managed by the ,department2 or 7#c7 other electronic communications systems owned and managed by the ,department or another appropriate ,federal agency1 whenever such systems are available4 7b7 ,certification and reporting 7#a7 ,certification ,except as provided in paragraphs 7#b7 and 7#c71 not later than #ij days after the date of the enactment of this ,act1 and annually thereafter1 the ,secretary shall certify in writing to the appropriate congressional committees that all employees of the ,department have been provided with access to electronic communications systems described in subsection 7a74 7#b7 ,reporting ,if the ,secretary cannot make the certification described in paragraph 7#a71 the ,secretary shall submit a report to the appropriate congressional committees that identifies-- 7,a7 the number of employees of the ,department who lack access to electronic communications systems described in subsection 7a72 7,b7 the reasons for such lack of access2 7,c7 the steps that have been taken to ensure that such employees obtain and maintain such access on a reliable basis2 and 7,d7 the steps that have been taken to ensure that work-related electronic communications by such employees are appropriately recorded1 archived1 and reviewed for the potential presence of classified information4 7#c7 ,waiver ,on a case by case basis1 the ,secretary of ,state may waive the requirements under subsection 7a7 for one employee1 or a group of up to #aj employees1 if1 not later than #g days after granting such waiver1 the ,secretary-- 7,a7 certifies in writing to the appropriate congressional committees that-- 7i7 such waiver is in the foreign policy or national security interest of the ,united ,states2 and 7ii7 all work-related written communications generated by or processed on nongovernmental systems by employees subject to such waiver will be appropriately archived in accordance with chapters #ba1 #bi1 #ca1 and #cc of title #dd1 ,united ,states ,code 7commonly referred to as the ,federal ,records ,act7 and all related rules1 regulations1 guidance1 and executive orders2 and 7,b7 provides a written justification for such waiver to the appropriate congressional committees4 7#d7 ,limitations 7,a7 ,duration ,waivers issued pursuant to paragraph 7#c7 shall be valid for up to #ahj days1 but may be reissued by the ,secretary in accordance with the requirements under paragraph 7#c74 7,b7 ,multiple waivers ,the ,secretary may issue multiple waivers under paragraph 7#c7 if each waiver is consistent with the certification and the accompanying justification4 7#e7 ,accountability ,not later than #ij days after the date of the enactment of this ,act1 the ,inspector ,general shall develop and implement an oversight plan designed to determine1 to the greatest extent practicable1 whether the ,secretary and all other employees of the ,department are in full compliance with the requirements under this section4 #d4 ,report on security reviews and violations 7a7 ,in general ,not later than #ij days after the date of the enactment of this ,act1 and annually thereafter1 the ,secretary shall submit a report to the appropriate congressional committees that details every security violation1 including the unauthorized transfer of marked or unmarked classified information into documents1 electronic media or systems1 electronic transmissions1 or other records or storage not certified for the handling1 storage1 or transmittal of such information1 that occurred during the most recently completed fiscal year4 7b7 ,contents ,the report required under subsection 7a7 shall include1 for each security violation identified in the report-- 7#a7 the name and title of the employee responsible for the violation2 7#b7 the date of the violation2 7#c7 a description of the violation1 including whether or not there is any indication that classified information was compromised2 7#d7 the statute1 rule1 executive order1 or regulation that was violated2 and 7#e7 a description of actions taken by officials of the ,department in response to the violation1 including-- 7,a7 any disciplinary action taken or criminal referral made against the employee involved2 and 7,b7 any remedial training administered to the employee involved or to other employees of the ,department2 and 7#f7 if the employee responsible for the violation had committed one or more additional security violations during the prior #aj years and the ,secretary did not terminate the employee or request the ,federal ,bureau of ,investigations to review the violation1 a justification for failing to take such actions4 7c7 ,privacy ,act protections ,the report required under subsection 7a7-- 7#a7 may not be made public by the ,department2 and 7#b7 shall be transmitted in such a manner so as to prevent the public dissemination of any information protected under the ,privacy ,act of #aigd 7#e ,u4,s4,c4 #eeb;a et seq474 #e4 ,classified information spillage 7a7 ,detection of classified information spillage ,the ,secretary shall appoint appropriate officials of the ,bureau of ,diplomatic ,security to receive training1 in coordination with the ,office of the ,director of ,national ,intelligence1 in the recognition of classified information spillage4 7b7 ,randomized sampling ,to detect spillage ,each quarter1 the officials appointed pursuant to subsection 7a7 shall-- 7#a7 collect statistically valid random samples of emails sent by or received from employees of the ,department who hold a security clearance granting them authorized access to information classified at the level of ,secret or above2 and 7#b7 use such randomized sampling1 in accordance with the training received under subsection 7a71 to detect classified information spillage as part of the ,department's program for safeguarding classified information4 7c7 ,accountability ,the ,inspector ,general shall-- 7#a7 audit the work described in subsection 7b72 and 7#b7 include the findings of such audits in the semiannual reports submitted to the appropriate congressional committees4 #f4 ,remedial training 7a7 ,emergency refresher training ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall certify in writing to the appropriate congressional committees that all personnel of the ,department who possess security clearances have completed the emergency refresher training described in subsection 7b74 7b7 ,contents ,the ,secretary shall require all personnel of the ,department who possess security clearances to complete emergency refresher training on the rules and procedures governing the appropriate handling of classified information1 including-- 7#a7 applicable rules and procedures governing-- 7,a7 the receipt1 handling1 and transmission of classified information by electronic means1 including telephonic1 text message1 facsimile1 and email communications2 7,b7 derivative classification1 and the imperative of continuing to safeguard classified information when drawing upon such information in the creation of secondary documents or other communications2 7,c7 the receipt1 handling1 and transmission of foreign government information 7as defined in section #f4a7s7 of ,executive ,order #acebf 7#bjji771 and the requirements set forth in sections #a4a7;d7 and #d4a7;h7 of such executive order2 7,d7 the review and processing of requests for information under section #eeb of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act72 7,e7 challenges to classification status1 including section #a4h of ,executive ,order #acebf 7#bjji72 and 7,f7 the continued protection of classified information that has been disclosed without authorization1 including the requirement under section #a4a7;c7 of ,executive ,order #acebf 7#bjji7 that classified information shall not be declassified automatically as a result of any unauthorized disclosure of identical or similar information2 7#b7 the requirement under section #e4d of ,executive ,order #acebf 7#bjji7 that the ,secretary-- 7,a7 demonstrate personal commitment and commit senior management to the successful implementation of the program established under this order2 7,b7 commit necessary resources to the effective implementation of programs for the handling and protection of classified information2 7,c7 ensure that agency records systems are designed and maintained to optimize the appropriate sharing and safeguarding of classified information2 7,d7 designate a senior agency official to direct and administer the program12 and 7,e7 include the designation and management of classified information as a critical element or item to be evaluated in personnel performance evaluations2 7#c7 a list and clear explanation of the penalties provided for violations of applicable rules and procedures governing the topics described in paragraphs 7#a7 and 7#b72 and 7#d7 a signed certification by the employee receiving such retraining that he or she-- 7,a7 has received such training2 7,b7 has read and understands the rules1 procedures1 and penalties described in paragraphs 7#a7 through 7#c72 7,c7 understands the grave responsibilities entailed by the privilege of being given access to national security information2 and 7,d7 undertakes under penalty of all applicable laws1 regulations1 and policies not to violate any of such rules and procedures4 7c7 ,prioritization ,the ,secretary shall prioritize the emergency refresher training described in subsection 7b7 in the following order3 7#a7 ,employees possessing security clearances at the ,top ,secret_/,sensitive ,compartmented ,information level4 7#b7 ,employees cleared for ,top ,secret information and below4 7#c7 ,employees cleared for ,secret information and below4 7#d7 ,employees only cleared for ,confidential information4 7d7 ,waiver ,the ,secretary may delay the administration of the emergency refresher training described in subsection 7b7 for any specific employee or group of employees1 up to the level of an individual office1 for a period of up to #cj days if the ,secretary-- 7#a7 determines that the critical foreign policy interests of the ,united ,states require such a delay2 and 7#b7 provides the appropriate congressional committees with written notice of such delay and an explanation of the need for such delay4 7e7 ,applicable rules and procedures defined ,in this section1 the term applicable rules and procedures means-- 7#a7 any applicable ,federal statute2 7#b7 all the requirements set forth on the topic in question by ,executive ,order #acebf 7#bjji72 7#c7 any other current executive order dealing with the handling of classified information2 7#d7 the ,foreign ,affairs ,manual of the ,department2 and 7#e7 any other ,departmental guidance or regulations4 #g4 ,enduring training program to prevent mishandling of intelligence information ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall establish an enduring training program1 which shall be administered annually to all employees of the ,department1 on how to prevent the transfer of marked or unmarked classified or sensitive information to documents1 messages1 electronic media1 or any other system not certified for the handling or storage of information with that level of classification or sensitivity and compliant with applicable ,federal ,information ,security ,management ,act standards1 including during the review or public release of any record pursuant to section #eeb of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act74 #h4 ,plan for reforming response to requests for information and information archiving 7a7 ,requirement for plan ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary shall submit a plan to the appropriate congressional committees for completing the reforms described in subsection 7b7 not later than one year after the date of the enactment of this ,act4 7b7 ,elements ,the plan required under subsection 7a7 shall include-- 7#a7 a process for developing and implementing1 in coordination with the ,director of ,national ,intelligence1 a program for training and maintaining an appropriate number of employees of the ,department in-- 7,a7 identifying marked or unmarked classified information in documents or media subject to requests under section #eeb of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act71 including information originating with the intelligence community2 and 7,b7 the appropriate procedures for ensuring that officials from the intelligence community have an opportunity to make a classification determination regarding the classification status and level1 if any1 of any information potentially originating with the intelligence community2 7#b7 a process for developing and implementing a training program for all officials of the ,department on how to archive emails and other electronic communications in accordance with chapters #ba1 #bi1 #ca1 and #cc of title #dd1 ,united ,states ,code1 and all related rules1 regulations1 guidance1 and executive orders2 and 7#c7 a requirement for the annual administration of a sworn affidavit made by each employee of the ,department certifying that such employee has1 to the best of the employee's knowledge and ability1 archived all documents 7including emails7 created or received by such employee in accordance with the chapters #ba1 #bi1 #ca1 and #cc of title #dd1 ,united ,states ,code1 and all related rules1 regulations1 guidance1 and executive orders4 7c7 ,accountability ,not later than one year after the date of the enactment of this ,act1 the ,inspector ,general1 after reviewing the implementation of the plan required under this section1 shall report to the appropriate congressional committees on the degree to which the ,secretary-- 7#a7 has implemented such plan2 and 7#b7 has made progress in ensuring appropriate archiving and securing of information by the ,department4