,,ii #aadth ,,congress #ast ,session ,s4 #def ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,february #aa1 #bjae,mr4 ,carper introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to codify mechanisms for enabling cybersecurity threat indicator sharing between private and government entities1 as well as among private entities1 to better protect information systems4 #a4 ,short title ,this ,act may be cited as the ,cyber ,threat ,sharing ,act of #bjae4 #b4 ,cyber threat indicator sharing 7a7 ,in general ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ada et seq47 is amended by adding at the end the following3 #bbi4 ,cyber threat indicator sharing 7a7 ,definitions ,in this section1 the following definitions shall apply3 7#a7 ,center ,the term ,center means the national cybersecurity and communications integration center established under the second section designated as section #bbf4 7#b7 ,cyber threat ,the term cyber threat-- 7,a7 means any action that may result in-- 7i7 unauthorized access in order to damage or impair the integrity1 confidentiality1 or availability of an information system2 or 7ii7 unauthorized exfiltration1 deletion1 or manipulation of information that is stored on1 processed by1 or transiting an information system2 and 7,b7 does not include exceeding authorized access of an information system1 if such access solely involves a violation of consumer terms of service or consumer licensing agreements4 7#c7 ,cyber threat indicator ,the term cyber threat indicator means information-- 7,a7 that is necessary to indicate1 describe1 or identify-- 7i7 malicious reconnaissance1 including communications that reasonably appear to be transmitted for the purpose of gathering technical information related to a cyber threat2 7ii7 a method of defeating a technical control or an operational control2 7iii7 a technical vulnerability2 7iv7 a method of causing a user with legitimate access to an information system or information that is stored on1 processed by1 or transiting an information system inadvertently to enable the defeat of a technical control or an operational control2 7v7 malicious cyber command and control2 or 7vi7 any combination of clauses 7i7 through 7v72 and 7,b7 from which reasonable efforts have been made to remove information that may be used to identify specific persons reasonably believed to be unrelated to the cyber threat4 7#d7 ,federal entity ,the term ,federal entity means-- 7,a7 an agency or department of the ,united ,states2 or 7,b7 any component1 officer1 employee1 or agent of such an agency or department1 acting in his or her official capacity4 7#e7 ,governmental entity ,the term governmental entity means-- 7,a7 any ,federal entity2 7,b7 any agency or department of a ,state1 local1 tribal1 or territorial government2 or 7,c7 any component1 officer1 employee1 or agent of such an agency or department1 acting in his or her official capacity4 7#f7 ,information ,sharing and ,analysis ,organization ,the term ,information ,sharing and ,analysis ,organization has the meaning given that term in section #bab4 7#g7 ,information system ,the term information system means a discrete set of hardware and software information resources that collects1 processes1 maintains1 uses1 shares1 disseminates1 or disposes of information and communications4 7#h7 ,malicious cyber command and control ,the term malicious cyber command and control means a method for remote identification of1 access to1 or use of1 an information system or information that is stored on1 processed by1 or transiting an information system that is known or reasonably suspected of being associated with a known or suspected cyber threat4 7#i7 ,malicious reconnaissance ,the term malicious reconnaissance' means a method for probing or monitoring an information system for the purpose of discerning technical vulnerabilities of the information system1 if such method is known or reasonably suspected of being associated with a known or suspected cyber threat4 7#aj7 ,non-,federal entity ,the term non-,federal entity means a private entity or a governmental entity other than a ,federal entity4 7#aa7 ,operational control ,the term operational control means a security control for an information system that is primarily implemented and executed by people4 7#ab7 ,private entity ,the term private entity-- 7,a7 has the meaning given the term person in section #a of title #a1 ,united ,states ,code2 and 7,b7 does not include a governmental entity or a foreign government1 or any component thereof4 7#ac7 ,sector-specific agency ,the term sector-specific agency has the meaning given that term in section #b7;e7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7;e774 7#ad7 ,technical control ,the term technical control means a hardware or software restriction on1 or audit of1 access or use of an information system or information that is stored on1 processed by1 or transiting an information system that is intended to ensure the confidentiality1 integrity1 or availability of that information system or the information processed or stored by that information system4 7#ae7 ,technical vulnerability ,the term technical vulnerability means any attribute of hardware1 firmware1 or software that could enable or facilitate the defeat of a technical control4 7b7 ,voluntary disclosure and receipt of cyber threat indicators 7#a7 ,in general ,notwithstanding any other provision of law1 a private entity may-- 7,a7 disclose a lawfully obtained cyber threat indicator to-- 7i7 a private ,information ,sharing and ,analysis ,organization2 and 7ii7 the ,center2 and 7,b7 receive a cyber threat indicator disclosed under this section by a ,federal or non-,federal entity4 7#b7 ,voluntary sharing with law enforcement ,any entity may disclose a lawfully obtained cyber threat indicator to a ,federal entity for investigative purposes consistent with the lawful authorities of the ,federal entity4 7#c7 ,use and protection of information ,a private entity that discloses or receives a cyber threat indicator under paragraph 7#a7-- 7,a7 may only use1 retain1 or further disclose the cyber threat indicator for the purpose of-- 7i7 protecting an information system or information that is stored on1 processed by1 or transiting an information system from cyber threats2 7ii7 identifying or mitigating such cyber threats2 or 7iii7 reporting a crime2 7,b7 shall take reasonable efforts-- 7i7 to minimize information that may be used to identify specific persons and is reasonably believed to be unrelated to a cyber threat2 and 7ii7 to safeguard information that may be used to identify specific persons from unintended disclosure and unauthorized access or acquisition2 and 7,c7 shall comply with reasonable restrictions that a private entity places on the subsequent disclosure or retention of a cyber threat indicator that the private entity discloses to other private entities4 7#d7 ,best practices for private ,information ,sharing and ,analysis ,organizations ,the ,secretary1 in consultation with the ,secretary of ,commerce1 the ,attorney ,general1 the ,director of the ,office of ,management and ,budget1 and the heads of sector-specific agencies and other appropriate ,federal agencies1 shall-- 7,a7 through an open and competitive process1 select a private entity to identify a common set of best practices for the creation and operation of private ,information ,sharing and ,analysis ,organizations2 or 7,b7 if necessary1 develop through an open and consultative process the common set of best practices described in subparagraph 7,a74 7c7 ,federal cyber threat indicator sharing 7#a7 ,civilian portal ,the ,secretary shall designate the ,center to receive and disclose cyber threat indicators to ,federal and non-,federal entities in as close to real time as practicable1 consistent with1 and in accordance with the purposes of1 this section4 7#b7 ,sharing with ,non-,federal entities 7,a7 ,in general ,to protect information systems or information that is stored on1 processed by1 or transiting an information system from cyber threats1 the ,secretary shall coordinate ,federal efforts to ensure that useful classified and unclassified cyber threat indicators are shared in a timely manner with non-,federal entities4 7,b7 ,report 7i7 ,in general ,not later than #a year after the date of enactment of this section1 and every year thereafter for #b years1 the ,secretary1 in consultation with the ,attorney ,general1 the ,director of the ,office of ,management and ,budget1 the ,director of ,national ,intelligence1 the ,secretary of ,defense1 and the heads of sector-specific agencies and other appropriate ,federal agencies1 shall submit to ,congress a report including-- 7,i7 a review of all ,federal efforts to share classified and unclassified cyber threat indicators to protect information systems from cyber threats1 including summaries of the nature of those efforts and the quantities of information shared2 7,,ii7 challenges to the appropriate sharing of cyber threat indicators2 and 7,,iii7 recommendations to enhance the appropriate sharing of cyber threat indicators4 7ii7 ,form of report ,each report submitted under clause 7i7 shall be in unclassified form1 but may include a classified annex4 7#c7 ,sharing among ,federal entities 7,a7 ,in general ,the ,secretary1 in consultation with the heads of appropriate agencies1 shall coordinate and establish procedures for the sharing of cyber threat indicators among ,federal agencies1 with appropriate consideration of privacy and civil liberties and agency equities4 7,b7 ,sharing by the ,center ,the ,secretary1 in consultation with the ,attorney ,general1 the ,director of the ,office of ,management and ,budget1 the ,director of ,national ,intelligence1 the ,secretary of ,defense1 and the heads of sector-specific agencies and other appropriate ,federal agencies1 shall ensure that cyber threat indicators received and disclosed by the ,center under paragraph 7#a7 are shared with other ,federal entities in as close to real time as practicable4 7#d7 ,real time sharing 7,a7 ,in general ,the ,secretary1 in coordination with the ,director of the ,national ,institute for ,standards and ,technology1 and consistent with the ,cybersecurity ,enhancement ,act of #bjad 7,public ,law #aac-bgd2 #abh ,stat4 #biga71 shall develop a program that supports and rapidly advances the development1 adoption1 and implementation of automated mechanisms for the real time sharing of cyber threat indicators4 7,b7 ,best practices ,to the maximum extent feasible1 the ,secretary shall ensure that the program developed under subparagraph 7,a7 relies on open source software development best practices4 7d7 ,limitation of liability 7#a7 ,liability for disclosure of cyber threat indicators 7,a7 ,in general ,a civil or criminal action may not be filed or maintained in a ,federal or ,state court against an entity for the voluntary disclosure or receipt under this section of a lawfully obtained cyber threat indicator1 that the entity was not otherwise required to disclose1 to or from-- 7i7 the ,center2 or 7ii7 a private ,information ,sharing and ,analysis ,organization1 if the organization maintains a publicly-available self-certification that the organization has adopted the best practices identified or developed under subsection 7b77#d74 7,b7 ,effective date ,subparagraph 7,a7 shall take effect on the date on which the policies and procedures are developed under subsection 7e77#a74 7#b7 ,protection from public disclosure 7,a7 ,in general ,a cyber threat indicator that is submitted by a non-,federal entity to the ,center shall be exempt from disclosure under-- 7i7 section #eeb7;b77#c7 of title #e1 ,united ,states ,code2 7ii7 section #eeb;a7d7 of title #e1 ,united ,states ,code2 and 7iii7 any ,state law otherwise requiring disclosure4 7,b7 ,application of section #bad 7i7 ,in general ,except as provided under clause 7ii71 a cyber threat indicator that is submitted by a non-,federal entity to the ,center shall be treated in the same manner as voluntarily submitted critical infrastructure information is treated under section #bad4 7ii7 ,exception ,for purposes of clause 7i71 the requirements under subsection 7a77#b7 7regarding an express statement7 and subsection 7e77#b77;,a7 7regarding acknowledgment of receipt7 of section #bad shall not apply4 7#c7 ,limitation of regulatory enforcement actions 7,a7 ,in general ,a ,federal entity may not use a cyber threat indicator received under this section as evidence in a regulatory enforcement action against an entity that disclosed the cyber threat indicator to the ,federal ,government under subsection 7c74 7,b7 ,exception ,nothing in subparagraph 7,a7 shall be construed to prevent a ,federal entity from using a cyber threat indicator received through lawful means other than under this section as evidence in a regulatory enforcement action1 even if the ,federal entity also receives the cyber threat indicator under this section4 7#d7 ,rule of construction ,nothing in this section shall be construed to prohibit or otherwise limit an ,information ,sharing and ,analysis ,organization1 information sharing and analysis center1 or other non-,federal entity from self-certifying under paragraph 7#a77;,a77ii7 that the entity has adopted the best practices identified or developed under subsection 7b77#d74 7e7 ,privacy protections 7#a7 ,policies and procedures 7,a7 ,in general ,the ,secretary1 in consultation with the ,attorney ,general1 the ,chief ,privacy ,officer of the ,department1 the ,chief ,privacy and ,civil ,liberties ,officer of the ,department of ,justice1 the ,secretary of ,commerce1 the ,director of ,national ,intelligence1 the ,secretary of ,defense1 the ,director of the ,office of ,management and ,budget1 the heads of sector-specific agencies and other appropriate agencies1 and the ,privacy and ,civil ,liberties ,oversight ,board1 shall develop and periodically review policies and procedures governing the receipt1 retention1 use1 and disclosure of a cyber threat indicator obtained by a ,federal entity under this section4 7,b7 ,requirements ,the policies and procedures developed under subparagraph 7,a7 shall-- 7i7 reasonably limit the acquisition1 interception1 retention1 use1 and disclosure of a cyber threat indicator that is reasonably likely to identify specific persons1 including by establishing a process-- 7,i7 for the timely destruction of information that is known not to be directly related to a purpose or use authorized under the section2 and 7,,ii7 to anonymize and safeguard information received and disclosed that may be used to identify specific persons unrelated to a cyber threat2 7ii7 except as provided under clause 7iii71 limit the reception1 use1 and retention of a cyber threat indicator by a ,federal entity only to protect information systems from cyber threats2 7iii7 for cyber threat indicators received by the ,center under subsection 7c77#a71 establish publicly available guidelines that authorize law enforcement use of a cyber threat indicator received by a ,federal entity under subsection 7c7 only to investigate1 prosecute1 disrupt1 or otherwise respond to-- 7,i7 a computer crime2 7,,ii7 a threat of death or serious bodily harm2 7,,iii7 a serious threat to a minor1 including sexual exploitation and threats to physical safety2 or 7,,iv7 an attempt or conspiracy to commit an offense described in subclause 7,i71 7,,ii71 or 7,,iii72 7iv7 preserve the confidentiality of disclosed proprietary information to the greatest extent practicable1 and require recipients of such information to be informed that the cyber threat indicator disclosed may only be used for the purposes authorized under this section2 and 7v7 provide for appropriate penalties for any officer1 employee1 or agent of an agency or department of the ,united ,states who violates the provisions of this section with respect to the receipt1 retention1 or disclosure of a cyber threat indicator4 7#b7 ,oversight by ,federal entities ,the head of each ,federal entity that receives or discloses a cyber threat indicator under this section shall establish a program to monitor and oversee compliance with the policies and procedures developed under paragraph 7#a77;,a74 7#c7 ,publication ,the policies and procedures developed under paragraph 7#a77;,a7 shall-- 7,a7 be provided to the appropriate congressional committees2 and 7,b7 to the maximum extent practicable1 shall be posted on the ,internet website of each ,federal entity that receives or discloses a cyber threat indicator under this section4 7#d7 ,reports 7,a7 ,annual report on privacy and civil liberties ,the ,chief ,privacy ,officer of the ,department and the ,chief ,privacy and ,civil ,liberties ,officer of the ,department of ,justice1 in consultation with the privacy and civil liberties officers of other appropriate ,federal agencies1 shall submit to ,congress an annual report assessing the privacy and civil liberties impact of the governmental activities conducted under this section4 7,b7 ,additional report 7i7 ,in general ,not later than #b years after the date of enactment of this section1 and every year thereafter for #b years1 the ,secretary1 the ,director of ,national ,intelligence1 the ,attorney ,general1 and the ,secretary of ,defense shall jointly submit to ,congress a report that-- 7,i7 describes the extent to which the authorities provided under this section have enabled the ,federal ,government and the private sector to mitigate cyber threats2 7,,ii7 discloses any significant acts of noncompliance by a non-,federal entity with this section1 with special emphasis on privacy and civil liberties1 and any measures taken by the ,federal ,government to uncover such noncompliance2 7,,iii7 describes in general terms the nature and quantity of information disclosed and received by governmental entities and private entities under this section2 7,,iv7 describes the uses by ,federal agencies of information received under this section1 including the general quantity of information being used for each purpose2 and 7,v7 identifies the emergence of new threats or technologies that challenge the adequacy of this section1 including the definitions1 authorities1 and requirements of this section1 for keeping pace with the threat4 7ii7 ,form of report ,each report submitted under clause 7i7 shall be submitted in unclassified form1 but may include a classified annex4 7f7 ,construction and ,federal preemption 7#a7 ,construction ,nothing in this section may be construed-- 7,a7 except as provided in subsection 7d77#b71 to limit any law or regulation that requires the disclosure1 receipt1 or retention of information2 7,b7 to limit the authority of an entity to share information concerning potential criminal activity or investigations with law enforcement entities2 7,c7 to limit or prohibit otherwise lawful disclosures of information by a private entity to any governmental or private entity not conducted under this section2 7,d7 to allow the otherwise unauthorized disclosure by a private entity of information or material that has been determined by the ,federal ,government pursuant to an ,executive order1 statute1 or regulation to require protection against unauthorized disclosure for reasons of national defense or foreign relations of the ,united ,states1 including-- 7i7 any restricted data1 as defined in section #aa7y7 of the ,atomic ,energy ,act of #aied 7#db ,u4,s4,c4 #bjad7y772 7ii7 information related to intelligence sources and methods2 and 7iii7 information that is specifically subject to a court order or a certification1 directive1 or other authority precluding such disclosure2 7,e7 to authorize or limit liability for actions that would-- 7i7 violate the ,report and ,order of the ,federal ,communications ,commission with regard to ,preserving the ,open ,internet2 ,broadband ,industry ,practices 7,,gn ,docket ,no4 #ji-aia1 ,,wc ,docket ,no4 #jg-eb7 7adopted ,december #ba1 #bjaj7 or any successor ,report or ,order thereto2 or 7ii7 modify or alter the obligations of private entities under ,report or ,order described in clause 7i72 or 7,f7 to allow price-fixing1 allocating a market between competitors1 monopolizing or attempting to monopolize a market1 boycotting or exchanges of price or cost information1 customer lists1 or information regarding future competitive planning4 7#b7 ,federal preemption ,this section supersedes any law or requirement of a ,state or political subdivision of a ,state that restricts or otherwise expressly regulates the retention1 use1 or disclosure of a cyber threat indicator by a private entity4 7#c7 ,preservation of other ,state law ,except as expressly provided1 nothing in this section shall be construed to preempt the applicability of any other ,state law or requirement4 7#d7 ,no creation of a right to information ,the provision of information to a non-,federal entity under this section does not create a right or benefit to similar information by any other non-,federal entity4 7#e7 ,no ,waiver of ,privilege ,no otherwise privileged communication obtained in accordance with1 or in violation of1 the provisions of this section shall lose its privileged character4 7#f7 ,prohibition on requirement to provide information to the ,federal ,government ,nothing in this section shall be construed to authorize a ,federal entity-- 7,a7 to require a non-,federal entity to share information with the ,federal ,government2 7,b7 to condition the disclosure of a cyber threat indicator under to this section to a non-,federal entity on the provision of cyber threat information to the ,federal ,government2 or 7,c7 to condition the award of any ,federal grant1 contract or purchase on the provision of a cyber threat indicator to a ,federal entity1 if the provision of the cyber threat indicator does not reasonably relate to the protection of the information system of the ,federal entity or information1 goods1 or services covered by the award4 4 7b7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja note7 is amended by inserting after the item relating to section #bbh the following3 ,sec4 #bbi4 ,cyber threat sharing4 4 7c7 ,sunset ,effective on the date that is #e years after the date of enactment of this ,act-- 7#a7 section #bbi of the ,homeland ,security ,act of #bjjb1 as added by subsection 7a71 is repealed2 and 7#b7 the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja note7 is amended by striking the item relating to section #bbi4 #c4 ,sense of ,congress ,it is the sense of ,congress that the statement issued by the ,department of ,justice and the ,federal ,trade ,commission on ,april #aj1 #bjad entitled ,antitrust ,policy ,statement ,on ,sharing ,of ,cybersecurity ,information provides protections against antitrust concerns for the legitimate sharing of cyber threat indicators 7as defined in section #bbi of the ,homeland ,security ,act of #bjjb 7as added by section #b774