,,ii ,calendar ,no4 #bh #aadth ,,congress #ast ,session ,s4 #ged ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #ag1 #bjae,mr4 ,burr1 from the ,select ,committee on ,intelligence1 reported the following original bill2 which was read twice and placed on the calendar ,a ,,bill ,to improve cybersecurity in the ,united ,states through enhanced sharing of information about cybersecurity threats1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,cybersecurity ,information ,sharing ,act of #bjae4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,definitions4,sec4 #c4 ,sharing of information by the ,federal ,government4,sec4 #d4 ,authorizations for preventing1 detecting1 analyzing1 and mitigating cybersecurity threats4,sec4 #e4 ,sharing of cyber threat indicators and defensive measures with the ,federal ,government4,sec4 #f4 ,protection from liability4,sec4 #g4 ,oversight of ,government activities4,sec4 #h4 ,construction and preemption4,sec4 #i4 ,report on cybersecurity threats4,sec4 #aj4 ,conforming amendments4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#b7 ,antitrust laws ,the term antitrust laws-- 7,a7 has the meaning given the term in section #a of the ,clayton ,act 7#ae ,u4,s4,c4 #ab72 7,b7 includes section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 to the extent that section #e of that ,act applies to unfair methods of competition2 and 7,c7 includes any ,state law that has the same intent and effect as the laws under subparagraphs 7,a7 and 7,b74 7#c7 ,appropriate ,federal entities ,the term appropriate ,federal entities means the following3 7,a7 ,the ,department of ,commerce4 7,b7 ,the ,department of ,defense4 7,c7 ,the ,department of ,energy4 7,d7 ,the ,department of ,homeland ,security4 7,e7 ,the ,department of ,justice4 7,f7 ,the ,department of the ,treasury4 7,g7 ,the ,office of the ,director of ,national ,intelligence4 7#d7 ,cybersecurity purpose ,the term cybersecurity purpose means the purpose of protecting an information system or information that is stored on1 processed by1 or transiting an information system from a cybersecurity threat or security vulnerability4 7#e7 ,cybersecurity threat 7,a7 ,in general ,except as provided in subparagraph 7,b71 the term cybersecurity threat means an action1 not protected by the ,first ,amendment to the ,constitution of the ,united ,states1 on or through an information system that may result in an unauthorized effort to adversely impact the security1 availability1 confidentiality1 or integrity of an information system or information that is stored on1 processed by1 or transiting an information system4 7,b7 ,exclusion ,the term cybersecurity threat does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement4 7#f7 ,cyber threat indicator ,the term cyber threat indicator means information that is necessary to describe or identify-- 7,a7 malicious reconnaissance1 including anomalous patterns of communications that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat or security vulnerability2 7,b7 a method of defeating a security control or exploitation of a security vulnerability2 7,c7 a security vulnerability1 including anomalous activity that appears to indicate the existence of a security vulnerability2 7,d7 a method of causing a user with legitimate access to an information system or information that is stored on1 processed by1 or transiting an information system to unwittingly enable the defeat of a security control or exploitation of a security vulnerability2 7,e7 malicious cyber command and control2 7,f7 the actual or potential harm caused by an incident1 including a description of the information exfiltrated as a result of a particular cybersecurity threat2 7,g7 any other attribute of a cybersecurity threat1 if disclosure of such attribute is not otherwise prohibited by law2 or 7,h7 any combination thereof4 7#g7 ,defensive measure 7,a7 ,in general ,except as provided in subparagraph 7,b71 the term defensive measure means an action1 device1 procedure1 signature1 technique1 or other measure applied to an information system or information that is stored on1 processed by1 or transiting an information system that detects1 prevents1 or mitigates a known or suspected cybersecurity threat or security vulnerability4 7,b7 ,exclusion ,the term defensive measure does not include a measure that destroys1 renders unusable1 or substantially harms an information system or data on an information system not belonging to-- 7i7 the private entity operating the measure2 or 7ii7 another entity or ,federal entity that is authorized to provide consent and has provided consent to that private entity for operation of such measure4 7#h7 ,entity 7,a7 ,in general ,except as otherwise provided in this paragraph1 the term entity means any private entity1 non-,federal government agency or department1 or ,state1 tribal1 or local government 7including a political subdivision1 department1 or component thereof74 7,b7 ,inclusions ,the term entity includes a government agency or department of the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 the ,virgin ,islands1 ,guam1 ,american ,samoa1 the ,northern ,mariana ,islands1 and any other territory or possession of the ,united ,states4 7,c7 ,exclusion ,the term entity does not include a foreign power as defined in section #aja of the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja74 7#i7 ,federal entity ,the term ,federal entity means a department or agency of the ,united ,states or any component of such department or agency4 7#aj7 ,information system ,the term information system-- 7,a7 has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code2 and 7,b7 includes industrial control systems1 such as supervisory control and data acquisition systems1 distributed control systems1 and programmable logic controllers4 7#aa7 ,local government ,the term local government means any borough1 city1 county1 parish1 town1 township1 village1 or other political subdivision of a ,state4 7#ab7 ,malicious cyber command and control ,the term malicious cyber command and control means a method for unauthorized remote identification of1 access to1 or use of1 an information system or information that is stored on1 processed by1 or transiting an information system4 7#ac7 ,malicious reconnaissance ,the term malicious reconnaissance means a method for actively probing or passively monitoring an information system for the purpose of discerning security vulnerabilities of the information system1 if such method is associated with a known or suspected cybersecurity threat4 7#ad7 ,monitor ,the term monitor means to acquire1 identify1 or scan1 or to possess1 information that is stored on1 processed by1 or transiting an information system4 7#ae7 ,private entity 7,a7 ,in general ,except as otherwise provided in this paragraph1 the term private entity means any person or private group1 organization1 proprietorship1 partnership1 trust1 cooperative1 corporation1 or other commercial or nonprofit entity1 including an officer1 employee1 or agent thereof4 7,b7 ,inclusion ,the term private entity includes a ,state1 tribal1 or local government performing electric utility services4 7,c7 ,exclusion ,the term private entity does not include a foreign power as defined in section #aja of the ,foreign ,intelligence ,surveillance ,act of #aigh 7#ej ,u4,s4,c4 #ahja74 7#af7 ,security control ,the term security control means the management1 operational1 and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality1 integrity1 and availability of an information system or its information4 7#ag7 ,security vulnerability ,the term security vulnerability means any attribute of hardware1 software1 process1 or procedure that could enable or facilitate the defeat of a security control4 7#ah7 ,tribal ,the term tribal has the meaning given the term ,indian tribe in section #d of the ,indian ,self-,determination and ,education ,assistance ,act 7#be ,u4,s4,c4 #dej;b74 #c4 ,sharing of information by the ,federal ,government 7a7 ,in general ,consistent with the protection of classified information1 intelligence sources and methods1 and privacy and civil liberties1 the ,director of ,national ,intelligence1 the ,secretary of ,homeland ,security1 the ,secretary of ,defense1 and the ,attorney ,general1 in consultation with the heads of the appropriate ,federal entities1 shall develop and promulgate procedures to facilitate and promote-- 7#a7 the timely sharing of classified cyber threat indicators in the possession of the ,federal ,government with cleared representatives of relevant entities2 7#b7 the timely sharing with relevant entities of cyber threat indicators or information in the possession of the ,federal ,government that may be declassified and shared at an unclassified level2 7#c7 the sharing with relevant entities1 or the public if appropriate1 of unclassified1 including controlled unclassified1 cyber threat indicators in the possession of the ,federal ,government2 and 7#d7 the sharing with entities1 if appropriate1 of information in the possession of the ,federal ,government about cybersecurity threats to such entities to prevent or mitigate adverse effects from such cybersecurity threats4 7b7 ,development of procedures 7#a7 ,in general ,the procedures developed and promulgated under subsection 7a7 shall-- 7,a7 ensure the ,federal ,government has and maintains the capability to share cyber threat indicators in real time consistent with the protection of classified information2 7,b7 incorporate1 to the greatest extent practicable1 existing processes and existing roles and responsibilities of ,federal and non-,federal entities for information sharing by the ,federal ,government1 including sector specific information sharing and analysis centers2 7,c7 include procedures for notifying entities that have received a cyber threat indicator from a ,federal entity under this ,act that is known or determined to be in error or in contravention of the requirements of this ,act or another provision of ,federal law or policy of such error or contravention2 7,d7 include requirements for ,federal entities receiving cyber threat indicators or defensive measures to implement and utilize security controls to protect against unauthorized access to or acquisition of such cyber threat indicators or defensive measures2 and 7,e7 include procedures that require a ,federal entity1 prior to the sharing of a cyber threat indicator-- 7i7 to review such cyber threat indicator to assess whether such cyber threat indicator contains any information that such ,federal entity knows at the time of sharing to be personal information of or identifying a specific person not directly related to a cybersecurity threat and remove such information2 or 7ii7 to implement and utilize a technical capability configured to remove any personal information of or identifying a specific person not directly related to a cybersecurity threat4 7#b7 ,coordination ,in developing the procedures required under this section1 the ,director of ,national ,intelligence1 the ,secretary of ,homeland ,security1 the ,secretary of ,defense1 and the ,attorney ,general shall coordinate with appropriate ,federal entities1 including the ,national ,laboratories 7as defined in section #b of the ,energy ,policy ,act of #bjje 7#db ,u4,s4,c4 #aehja771 to ensure that effective protocols are implemented that will facilitate and promote the sharing of cyber threat indicators by the ,federal ,government in a timely manner4 7c7 ,submittal to ,congress ,not later than #fj days after the date of the enactment of this ,act1 the ,director of ,national ,intelligence1 in consultation with the heads of the appropriate ,federal entities1 shall submit to ,congress the procedures required by subsection 7a74 #d4 ,authorizations for preventing1 detecting1 analyzing1 and mitigating cybersecurity threats 7a7 ,authorization for monitoring 7#a7 ,in general ,notwithstanding any other provision of law1 a private entity may1 for cybersecurity purposes1 monitor-- 7,a7 an information system of such private entity2 7,b7 an information system of another entity1 upon the authorization and written consent of such other entity2 7,c7 an information system of a ,federal entity1 upon the authorization and written consent of an authorized representative of the ,federal entity2 and 7,d7 information that is stored on1 processed by1 or transiting an information system monitored by the private entity under this paragraph4 7#b7 ,construction ,nothing in this subsection shall be construed-- 7,a7 to authorize the monitoring of an information system1 or the use of any information obtained through such monitoring1 other than as provided in this ,act2 or 7,b7 to limit otherwise lawful activity4 7b7 ,authorization for operation of defensive measures 7#a7 ,in general ,notwithstanding any other provision of law1 a private entity may1 for cybersecurity purposes1 operate a defensive measure that is applied to-- 7,a7 an information system of such private entity in order to protect the rights or property of the private entity2 7,b7 an information system of another entity upon written consent of such entity for operation of such defensive measure to protect the rights or property of such entity2 and 7,c7 an information system of a ,federal entity upon written consent of an authorized representative of such ,federal entity for operation of such defensive measure to protect the rights or property of the ,federal ,government4 7#b7 ,construction ,nothing in this subsection shall be construed-- 7,a7 to authorize the use of a defensive measure other than as provided in this subsection2 or 7,b7 to limit otherwise lawful activity4 7c7 ,authorization for sharing or receiving cyber threat indicators or defensive measures 7#a7 ,in general ,except as provided in paragraph 7#b7 and notwithstanding any other provision of law1 an entity may1 for the purposes permitted under this ,act and consistent with the protection of classified information1 share with1 or receive from1 any other entity or the ,federal ,government a cyber threat indicator or defensive measure4 7#b7 ,lawful restriction ,an entity receiving a cyber threat indicator or defensive measure from another entity or ,federal entity shall comply with otherwise lawful restrictions placed on the sharing or use of such cyber threat indicator or defensive measure by the sharing entity or ,federal entity4 7#c7 ,construction ,nothing in this subsection shall be construed-- 7,a7 to authorize the sharing or receiving of a cyber threat indicator or defensive measure other than as provided in this subsection2 or 7,b7 to limit otherwise lawful activity4 7d7 ,protection and use of information 7#a7 ,security of information ,an entity monitoring an information system1 operating a defensive measure1 or providing or receiving a cyber threat indicator or defensive measure under this section shall implement and utilize a security control to protect against unauthorized access to or acquisition of such cyber threat indicator or defensive measure4 7#b7 ,removal of certain personal information ,an entity sharing a cyber threat indicator pursuant to this ,act shall1 prior to such sharing-- 7,a7 review such cyber threat indicator to assess whether such cyber threat indicator contains any information that the entity knows at the time of sharing to be personal information of or identifying a specific person not directly related to a cybersecurity threat and remove such information2 or 7,b7 implement and utilize a technical capability configured to remove any information contained within such indicator that the entity knows at the time of sharing to be personal information of or identifying a specific person not directly related to a cybersecurity threat4 7#c7 ,use of cyber threat indicators and defensive measures by entities 7,a7 ,in general ,consistent with this ,act1 a cyber threat indicator or defensive measure shared or received under this section may1 for cybersecurity purposes-- 7i7 be used by an entity to monitor or operate a defensive measure on-- 7,i7 an information system of the entity2 or 7,,ii7 an information system of another entity or a ,federal entity upon the written consent of that other entity or that ,federal entity2 and 7ii7 be otherwise used1 retained1 and further shared by an entity subject to-- 7,i7 an otherwise lawful restriction placed by the sharing entity or ,federal entity on such cyber threat indicator or defensive measure2 or 7,,ii7 an otherwise applicable provision of law4 7,b7 ,construction ,nothing in this paragraph shall be construed to authorize the use of a cyber threat indicator or defensive measure other than as provided in this section4 7#d7 ,use of cyber threat indicators by ,state1 tribal1 or local government 7,a7 ,law enforcement use 7i7 ,prior written consent ,except as provided in clause 7ii71 a cyber threat indicator shared with a ,state1 tribal1 or local government under this section may1 with the prior written consent of the entity sharing such indicator1 be used by a ,state1 tribal1 or local government for the purpose of preventing1 investigating1 or prosecuting any of the offenses described in section #e7;d77#e77;,a77vi74 7ii7 ,oral consent ,if exigent circumstances prevent obtaining written consent under clause 7i71 such consent may be provided orally with subsequent documentation of the consent4 7,b7 ,exemption from disclosure ,a cyber threat indicator shared with a ,state1 tribal1 or local government under this section shall be-- 7i7 deemed voluntarily shared information2 and 7ii7 exempt from disclosure under any ,state1 tribal1 or local law requiring disclosure of information or records4 7,c7 ,state1 tribal1 and local regulatory authority 7i7 ,in general ,except as provided in clause 7ii71 a cyber threat indicator or defensive measure shared with a ,state1 tribal1 or local government under this ,act shall not be directly used by any ,state1 tribal1 or local government to regulate1 including an enforcement action1 the lawful activity of any entity1 including an activity relating to monitoring1 operating a defensive measure1 or sharing of a cyber threat indicator4 7ii7 ,regulatory authority specifically relating to prevention or mitigation of cybersecurity threats ,a cyber threat indicator or defensive measures shared as described in clause 7i7 may1 consistent with a ,state1 tribal1 or local government regulatory authority specifically relating to the prevention or mitigation of cybersecurity threats to information systems1 inform the development or implementation of a regulation relating to such information systems4 7e7 ,antitrust exemption 7#a7 ,in general ,except as provided in section #h7;e71 it shall not be considered a violation of any provision of antitrust laws for #b or more private entities to exchange or provide a cyber threat indicator1 or assistance relating to the prevention1 investigation1 or mitigation of a cybersecurity threat1 for cybersecurity purposes under this ,act4 7#b7 ,applicability ,paragraph 7#a7 shall apply only to information that is exchanged or assistance provided in order to assist with-- 7,a7 facilitating the prevention1 investigation1 or mitigation of a cybersecurity threat to an information system or information that is stored on1 processed by1 or transiting an information system2 or 7,b7 communicating or disclosing a cyber threat indicator to help prevent1 investigate1 or mitigate the effect of a cybersecurity threat to an information system or information that is stored on1 processed by1 or transiting an information system4 7f7 ,no right or benefit ,the sharing of a cyber threat indicator with an entity under this ,act shall not create a right or benefit to similar information by such entity or any other entity4 #e4 ,sharing of cyber threat indicators and defensive measures with the ,federal ,government 7a7 ,requirement for policies and procedures 7#a7 ,interim policies and procedures ,not later than #fj days after the date of the enactment of this ,act1 the ,attorney ,general1 in coordination with the heads of the appropriate ,federal entities1 shall develop and submit to ,congress interim policies and procedures relating to the receipt of cyber threat indicators and defensive measures by the ,federal ,government4 7#b7 ,final policies and procedures ,not later than #ahj days after the date of the enactment of this ,act1 the ,attorney ,general shall1 in coordination with the heads of the appropriate ,federal entities1 promulgate final policies and procedures relating to the receipt of cyber threat indicators and defensive measures by the ,federal ,government4 7#c7 ,requirements concerning policies and procedures ,consistent with the guidelines required by subsection 7b71 the policies and procedures developed and promulgated under this subsection shall-- 7,a7 ensure that cyber threat indicators are shared with the ,federal ,government by any entity pursuant to section #d7;c7 through the real-time process described in subsection 7c7 of this section-- 7i7 are shared in an automated manner with all of the appropriate ,federal entities2 7ii7 are not subject to any delay1 modification1 or any other action that could impede real-time receipt by all of the appropriate ,federal entities2 and 7iii7 may be provided to other ,federal entities2 7,b7 ensure that cyber threat indicators shared with the ,federal ,government by any entity pursuant to section #d in a manner other than the real-time process described in subsection 7c7 of this section-- 7i7 are shared as quickly as operationally practicable with all of the appropriate ,federal entities2 7ii7 are not subject to any unnecessary delay1 interference1 or any other action that could impede receipt by all of the appropriate ,federal entities2 and 7iii7 may be provided to other ,federal entities2 7,c7 consistent with this ,act1 any other applicable provisions of law1 and the fair information practice principles set forth in appendix ,a of the document entitled ,national ,strategy for ,trusted ,identities in ,cyberspace and published by the ,president in ,april #bjaa1 govern the retention1 use1 and dissemination by the ,federal ,government of cyber threat indicators shared with the ,federal ,government under this ,act1 including the extent1 if any1 to which such cyber threat indicators may be used by the ,federal ,government2 and 7,d7 ensure there is-- 7i7 an audit capability2 and 7ii7 appropriate sanctions in place for officers1 employees1 or agents of a ,federal entity who knowingly and willfully conduct activities under this ,act in an unauthorized manner4 7#d7 ,guidelines for entities sharing cyber threat indicators with ,federal ,government 7,a7 ,in general ,not later than #fj days after the date of the enactment of this ,act1 the ,attorney ,general shall develop and make publicly available guidance to assist entities and promote sharing of cyber threat indicators with ,federal entities under this ,act4 7,b7 ,contents ,the guidelines developed and made publicly available under subparagraph 7,a7 shall include guidance on the following3 7i7 ,identification of types of information that would qualify as a cyber threat indicator under this ,act that would be unlikely to include personal information of or identifying a specific person not directly related to a cyber security threat4 7ii7 ,identification of types of information protected under otherwise applicable privacy laws that are unlikely to be directly related to a cybersecurity threat4 7iii7 ,such other matters as the ,attorney ,general considers appropriate for entities sharing cyber threat indicators with ,federal entities under this ,act4 7b7 ,privacy and civil liberties 7#a7 ,guidelines of ,attorney ,general ,not later than #fj days after the date of the enactment of this ,act1 the ,attorney ,general shall1 in coordination with heads of the appropriate ,federal entities and in consultation with officers designated under section #ajfb of the ,national ,security ,intelligence ,reform ,act of #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a71 develop1 submit to ,congress1 and make available to the public interim guidelines relating to privacy and civil liberties which shall govern the receipt1 retention1 use1 and dissemination of cyber threat indicators by a ,federal entity obtained in connection with activities authorized in this ,act4 7#b7 ,final guidelines 7,a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,attorney ,general shall1 in coordination with heads of the appropriate ,federal entities and in consultation with officers designated under section #ajfb of the ,national ,security ,intelligence ,reform ,act of #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a7 and such private entities with industry expertise as the ,attorney ,general considers relevant1 promulgate final guidelines relating to privacy and civil liberties which shall govern the receipt1 retention1 use1 and dissemination of cyber threat indicators by a ,federal entity obtained in connection with activities authorized in this ,act4 7,b7 ,periodic review ,the ,attorney ,general shall1 in coordination with heads of the appropriate ,federal entities and in consultation with officers and private entities described in subparagraph 7,a71 periodically review the guidelines promulgated under subparagraph 7,a74 7#c7 ,content ,the guidelines required by paragraphs 7#a7 and 7#b7 shall1 consistent with the need to protect information systems from cybersecurity threats and mitigate cybersecurity threats-- 7,a7 limit the impact on privacy and civil liberties of activities by the ,federal ,government under this ,act2 7,b7 limit the receipt1 retention1 use1 and dissemination of cyber threat indicators containing personal information of or identifying specific persons1 including by establishing-- 7i7 a process for the timely destruction of such information that is known not to be directly related to uses authorized under this ,act2 and 7ii7 specific limitations on the length of any period in which a cyber threat indicator may be retained2 7,c7 include requirements to safeguard cyber threat indicators containing personal information of or identifying specific persons from unauthorized access or acquisition1 including appropriate sanctions for activities by officers1 employees1 or agents of the ,federal ,government in contravention of such guidelines2 7,d7 include procedures for notifying entities and ,federal entities if information received pursuant to this section is known or determined by a ,federal entity receiving such information not to constitute a cyber threat indicator2 7,e7 protect the confidentiality of cyber threat indicators containing personal information of or identifying specific persons to the greatest extent practicable and require recipients to be informed that such indicators may only be used for purposes authorized under this ,act2 and 7,f7 include steps that may be needed so that dissemination of cyber threat indicators is consistent with the protection of classified and other sensitive national security information4 7c7 ,capability and process within the ,department of ,homeland ,security 7#a7 ,in general ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary of ,homeland ,security1 in coordination with the heads of the appropriate ,federal entities1 shall develop and implement a capability and process within the ,department of ,homeland ,security that-- 7,a7 shall accept from any entity in real time cyber threat indicators and defensive measures1 pursuant to this section2 7,b7 shall1 upon submittal of the certification under paragraph 7#b7 that such capability and process fully and effectively operates as described in such paragraph1 be the process by which the ,federal ,government receives cyber threat indicators and defensive measures under this ,act that are shared by a private entity with the ,federal ,government through electronic mail or media1 an interactive form on an ,internet website1 or a real time1 automated process between information systems except-- 7i7 communications between a ,federal entity and a private entity regarding a previously shared cyber threat indicator2 and 7ii7 communications by a regulated entity with such entity's ,federal regulatory authority regarding a cybersecurity threat2 7,c7 ensures that all of the appropriate ,federal entities receive in an automated manner such cyber threat indicators shared through the real-time process within the ,department of ,homeland ,security2 7,d7 is in compliance with the policies1 procedures1 and guidelines required by this section2 and 7,e7 does not limit or prohibit otherwise lawful disclosures of communications1 records1 or other information1 including-- 7i7 reporting of known or suspected criminal activity1 by an entity to any other entity or a ,federal entity2 7ii7 voluntary or legally compelled participation in a ,federal investigation2 and 7iii7 providing cyber threat indicators or defensive measures as part of a statutory or authorized contractual requirement4 7#b7 ,certification ,not later than #aj days prior to the implementation of the capability and process required by paragraph 7#a71 the ,secretary of ,homeland ,security shall1 in consultation with the heads of the appropriate ,federal entities1 certify to ,congress whether such capability and process fully and effectively operates-- 7,a7 as the process by which the ,federal ,government receives from any entity a cyber threat indicator or defensive measure under this ,act2 and 7,b7 in accordance with the policies1 procedures1 and guidelines developed under this section4 7#c7 ,public notice and access ,the ,secretary of ,homeland ,security shall ensure there is public notice of1 and access to1 the capability and process developed and implemented under paragraph 7#a7 so that-- 7,a7 any entity may share cyber threat indicators and defensive measures through such process with the ,federal ,government2 and 7,b7 all of the appropriate ,federal entities receive such cyber threat indicators and defensive measures in real time with receipt through the process within the ,department of ,homeland ,security4 7#d7 ,other ,federal entities ,the process developed and implemented under paragraph 7#a7 shall ensure that other ,federal entities receive in a timely manner any cyber threat indicators and defensive measures shared with the ,federal ,government through such process4 7#e7 ,report on development and implementation 7,a7 ,in general ,not later than #fj days after the date of the enactment of this ,act1 the ,secretary of ,homeland ,security shall submit to ,congress a report on the development and implementation of the capability and process required by paragraph 7#a71 including a description of such capability and process and the public notice of1 and access to1 such process4 7,b7 ,classified annex ,the report required by subparagraph 7,a7 shall be submitted in unclassified form1 but may include a classified annex4 7d7 ,information shared with or provided to the ,federal ,government 7#a7 ,no waiver of privilege or protection ,the provision of cyber threat indicators and defensive measures to the ,federal ,government under this ,act shall not constitute a waiver of any applicable privilege or protection provided by law1 including trade secret protection4 7#b7 ,proprietary information ,consistent with section #d7;c77#b71 a cyber threat indicator or defensive measure provided by an entity to the ,federal ,government under this ,act shall be considered the commercial1 financial1 and proprietary information of such entity when so designated by the originating entity or a third party acting in accordance with the written authorization of the originating entity4 7#c7 ,exemption from disclosure ,cyber threat indicators and defensive measures provided to the ,federal ,government under this ,act shall be-- 7,a7 deemed voluntarily shared information and exempt from disclosure under section #eeb of title #e1 ,united ,states ,code1 and any ,state1 tribal1 or local law requiring disclosure of information or records2 and 7,b7 withheld1 without discretion1 from the public under section #eeb7;b77#c77;,b7 of title #e1 ,united ,states ,code1 and any ,state1 tribal1 or local provision of law requiring disclosure of information or records4 7#d7 ,ex parte communications ,the provision of a cyber threat indicator or defensive measure to the ,federal ,government under this ,act shall not be subject to a rule of any ,federal agency or department or any judicial doctrine regarding ex parte communications with a decisionmaking official4 7#e7 ,disclosure1 retention1 and use 7,a7 ,authorized activities ,cyber threat indicators and defensive measures provided to the ,federal ,government under this ,act may be disclosed to1 retained by1 and used by1 consistent with otherwise applicable provisions of ,federal law1 any ,federal agency or department1 component1 officer1 employee1 or agent of the ,federal ,government solely for-- 7i7 a cybersecurity purpose2 7ii7 the purpose of identifying a cybersecurity threat1 including the source of such cybersecurity threat1 or a security vulnerability2 7iii7 the purpose of identifying a cybersecurity threat involving the use of an information system by a foreign adversary or terrorist2 7iv7 the purpose of responding to1 or otherwise preventing or mitigating1 an imminent threat of death1 serious bodily harm1 or serious economic harm1 including a terrorist act or a use of a weapon of mass destruction2 7v7 the purpose of responding to1 or otherwise preventing or mitigating1 a serious threat to a minor1 including sexual exploitation and threats to physical safety2 or 7vi7 the purpose of preventing1 investigating1 disrupting1 or prosecuting an offense arising out of a threat described in clause 7iv7 or any of the offenses listed in-- 7,i7 section #ceei7;c77#b77;,f7 of title #ah1 ,united ,states ,code 7relating to serious violent felonies72 7,,ii7 sections #ajbh through #ajcj of such title 7relating to fraud and identity theft72 7,,iii7 chapter #cg of such title 7relating to espionage and censorship72 and 7,,iv7 chapter #ij of such title 7relating to protection of trade secrets74 7,b7 ,prohibited activities ,cyber threat indicators and defensive measures provided to the ,federal ,government under this ,act shall not be disclosed to1 retained by1 or used by any ,federal agency or department for any use not permitted under subparagraph 7,a74 7,c7 ,privacy and civil liberties ,cyber threat indicators and defensive measures provided to the ,federal ,government under this ,act shall be retained1 used1 and disseminated by the ,federal ,government-- 7i7 in accordance with the policies1 procedures1 and guidelines required by subsections 7a7 and 7b72 7ii7 in a manner that protects from unauthorized use or disclosure any cyber threat indicators that may contain personal information of or identifying specific persons2 and 7iii7 in a manner that protects the confidentiality of cyber threat indicators containing personal information of or identifying a specific person4 7,d7 ,federal regulatory authority 7i7 ,in general ,except as provided in clause 7ii71 cyber threat indicators and defensive measures provided to the ,federal ,government under this ,act shall not be directly used by any ,federal1 ,state1 tribal1 or local government to regulate1 including an enforcement action1 the lawful activities of any entity1 including activities relating to monitoring1 operating defensive measures1 or sharing cyber threat indicators4 7ii7 ,exceptions 7,i7 ,regulatory authority specifically relating to prevention or mitigation of cybersecurity threats ,cyber threat indicators and defensive measures provided to the ,federal ,government under this ,act may1 consistent with ,federal or ,state regulatory authority specifically relating to the prevention or mitigation of cybersecurity threats to information systems1 inform the development or implementation of regulations relating to such information systems4 7,,ii7 ,procedures developed and implemented under this ,act ,clause 7i7 shall not apply to procedures developed and implemented under this ,act4 #f4 ,protection from liability 7a7 ,monitoring of information systems ,no cause of action shall lie or be maintained in any court against any private entity1 and such action shall be promptly dismissed1 for the monitoring of information systems and information under section #d7;a7 that is conducted in accordance with this ,act4 7b7 ,sharing or receipt of cyber threat indicators ,no cause of action shall lie or be maintained in any court against any entity1 and such action shall be promptly dismissed1 for the sharing or receipt of cyber threat indicators or defensive measures under section #d7;c7 if-- 7#a7 such sharing or receipt is conducted in accordance with this ,act2 and 7#b7 in a case in which a cyber threat indicator or defensive measure is shared with the ,federal ,government1 the cyber threat indicator or defensive measure is shared in a manner that is consistent with section #e7;c77#a77;,b7 and the sharing or receipt1 as the case may be1 occurs after the earlier of-- 7,a7 the date on which the interim policies and procedures are submitted to ,congress under section #e7;a77#a72 or 7,b7 the date that is #fj days after the date of the enactment of this ,act4 7c7 ,construction ,nothing in this section shall be construed-- 7#a7 to require dismissal of a cause of action against an entity that has engaged in gross negligence or willful misconduct in the course of conducting activities authorized by this ,act2 or 7#b7 to undermine or limit the availability of otherwise applicable common law or statutory defenses4 #g4 ,oversight of ,government activities 7a7 ,biennial report on implementation 7#a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 and not less frequently than once every #b years thereafter1 the heads of the appropriate ,federal entities shall jointly submit and the ,inspector ,general of the ,department of ,homeland ,security1 the ,inspector ,general of the ,intelligence ,community1 the ,inspector ,general of the ,department of ,justice1 the ,inspector ,general of the ,department of ,defense1 and the ,inspector ,general of the ,department of ,energy1 in consultation with the ,council of ,inspectors ,general on ,financial ,oversight1 shall jointly submit to ,congress a detailed report concerning the implementation of this ,act4 7#b7 ,contents ,each report submitted under paragraph 7#a7 shall include the following3 7,a7 ,an assessment of the sufficiency of the policies1 procedures1 and guidelines required by section #e in ensuring that cyber threat indicators are shared effectively and responsibly within the ,federal ,government4 7,b7 ,an evaluation of the effectiveness of real-time information sharing through the capability and process developed under section #e7;c71 including any impediments to such real-time sharing4 7,c7 ,an assessment of the sufficiency of the procedures developed under section #c in ensuring that cyber threat indicators in the possession of the ,federal ,government are shared in a timely and adequate manner with appropriate entities1 or1 if appropriate1 are made publicly available4 7,d7 ,an assessment of whether cyber threat indicators have been properly classified and an accounting of the number of security clearances authorized by the ,federal ,government for the purposes of this ,act4 7,e7 ,a review of the type of cyber threat indicators shared with the ,federal ,government under this ,act1 including the following3 7i7 ,the degree to which such information may impact the privacy and civil liberties of specific persons4 7ii7 ,a quantitative and qualitative assessment of the impact of the sharing of such cyber threat indicators with the ,federal ,government on privacy and civil liberties of specific persons4 7iii7 ,the adequacy of any steps taken by the ,federal ,government to reduce such impact4 7,f7 ,a review of actions taken by the ,federal ,government based on cyber threat indicators shared with the ,federal ,government under this ,act1 including the appropriateness of any subsequent use or dissemination of such cyber threat indicators by a ,federal entity under section #e4 7,g7 ,a description of any significant violations of the requirements of this ,act by the ,federal ,government4 7,h7 ,a summary of the number and type of entities that received classified cyber threat indicators from the ,federal ,government under this ,act and an evaluation of the risks and benefits of sharing such cyber threat indicators4 7#c7 ,recommendations ,each report submitted under paragraph 7#a7 may include recommendations for improvements or modifications to the authorities and processes under this ,act4 7#d7 ,form of report ,each report required by paragraph 7#a7 shall be submitted in unclassified form1 but may include a classified annex4 7b7 ,reports on privacy and civil liberties 7#a7 ,biennial report from ,privacy and ,civil ,liberties ,oversight ,board ,not later than #b years after the date of the enactment of this ,act and not less frequently than once every #b years thereafter1 the ,privacy and ,civil ,liberties ,oversight ,board shall submit to ,congress and the ,president a report providing-- 7,a7 an assessment of the effect on privacy and civil liberties by the type of activities carried out under this ,act2 and 7,b7 an assessment of the sufficiency of the policies1 procedures1 and guidelines established pursuant to section #e in addressing concerns relating to privacy and civil liberties4 7#b7 ,biennial report of ,inspectors general 7,a7 ,in general ,not later than #b years after the date of the enactment of this ,act and not less frequently than once every #b years thereafter1 the ,inspector ,general of the ,department of ,homeland ,security1 the ,inspector ,general of the ,intelligence ,community1 the ,inspector ,general of the ,department of ,justice1 the ,inspector ,general of the ,department of ,defense1 and the ,inspector ,general of the ,department of ,energy shall1 in consultation with the ,council of ,inspectors ,general on ,financial ,oversight1 jointly submit to ,congress a report on the receipt1 use1 and dissemination of cyber threat indicators and defensive measures that have been shared with ,federal entities under this ,act4 7,b7 ,contents ,each report submitted under subparagraph 7,a7 shall include the following3 7i7 ,a review of the types of cyber threat indicators shared with ,federal entities4 7ii7 ,a review of the actions taken by ,federal entities as a result of the receipt of such cyber threat indicators4 7iii7 ,a list of ,federal entities receiving such cyber threat indicators4 7iv7 ,a review of the sharing of such cyber threat indicators among ,federal entities to identify inappropriate barriers to sharing information4 7#c7 ,recommendations ,each report submitted under this subsection may include such recommendations as the ,privacy and ,civil ,liberties ,oversight ,board1 with respect to a report submitted under paragraph 7#a71 or the ,inspectors ,general referred to in paragraph 7#b77;,a71 with respect to a report submitted under paragraph 7#b71 may have for improvements or modifications to the authorities under this ,act4 7#d7 ,form ,each report required under this subsection shall be submitted in unclassified form1 but may include a classified annex4 #h4 ,construction and preemption 7a7 ,otherwise lawful disclosures ,nothing in this ,act shall be construed-- 7#a7 to limit or prohibit otherwise lawful disclosures of communications1 records1 or other information1 including reporting of known or suspected criminal activity1 by an entity to any other entity or the ,federal ,government under this ,act2 or 7#b7 to limit or prohibit otherwise lawful use of such disclosures by any ,federal entity1 even when such otherwise lawful disclosures duplicate or replicate disclosures made under this ,act4 7b7 ,whistle blower protections ,nothing in this ,act shall be construed to prohibit or limit the disclosure of information protected under section #bcjb7;b77#h7 of title #e1 ,united ,states ,code 7governing disclosures of illegality1 waste1 fraud1 abuse1 or public health or safety threats71 section #gbaa of title #e1 ,united ,states ,code 7governing disclosures to ,congress71 section #ajcd of title #aj1 ,united ,states ,code 7governing disclosure to ,congress by members of the military71 section #aajd of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cbcd7 7governing disclosure by employees of elements of the intelligence community71 or any similar provision of ,federal or ,state law4 7c7 ,protection of sources and methods ,nothing in this ,act shall be construed-- 7#a7 as creating any immunity against1 or otherwise affecting1 any action brought by the ,federal ,government1 or any agency or department thereof1 to enforce any law1 executive order1 or procedure governing the appropriate handling1 disclosure1 or use of classified information2 7#b7 to affect the conduct of authorized law enforcement or intelligence activities2 or 7#c7 to modify the authority of a department or agency of the ,federal ,government to protect classified information and sources and methods and the national security of the ,united ,states4 7d7 ,relationship to other laws ,nothing in this ,act shall be construed to affect any requirement under any other provision of law for an entity to provide information to the ,federal ,government4 7e7 ,prohibited conduct ,nothing in this ,act shall be construed to permit price-fixing1 allocating a market between competitors1 monopolizing or attempting to monopolize a market1 boycotting1 or exchanges of price or cost information1 customer lists1 or information regarding future competitive planning4 7f7 ,information sharing relationships ,nothing in this ,act shall be construed-- 7#a7 to limit or modify an existing information sharing relationship2 7#b7 to prohibit a new information sharing relationship2 7#c7 to require a new information sharing relationship between any entity and the ,federal ,government2 or 7#d7 to require the use of the capability and process within the ,department of ,homeland ,security developed under section #e7;c74 7g7 ,preservation of contractual obligations and rights ,nothing in this ,act shall be construed-- 7#a7 to amend1 repeal1 or supersede any current or future contractual agreement1 terms of service agreement1 or other contractual relationship between any entities1 or between any entity and a ,federal entity2 or 7#b7 to abrogate trade secret or intellectual property rights of any entity or ,federal entity4 7h7 ,anti-,tasking restriction ,nothing in this ,act shall be construed to permit the ,federal ,government-- 7#a7 to require an entity to provide information to the ,federal ,government2 7#b7 to condition the sharing of cyber threat indicators with an entity on such entity's provision of cyber threat indicators to the ,federal ,government2 or 7#c7 to condition the award of any ,federal grant1 contract1 or purchase on the provision of a cyber threat indicator to a ,federal entity4 7i7 ,no liability for non-,participation ,nothing in this ,act shall be construed to subject any entity to liability for choosing not to engage in the voluntary activities authorized in this ,act4 7j7 ,use and retention of information ,nothing in this ,act shall be construed to authorize1 or to modify any existing authority of1 a department or agency of the ,federal ,government to retain or use any information shared under this ,act for any use other than permitted in this ,act4 7k7 ,federal preemption 7#a7 ,in general ,this ,act supersedes any statute or other provision of law of a ,state or political subdivision of a ,state that restricts or otherwise expressly regulates an activity authorized under this ,act4 7#b7 ,state law enforcement ,nothing in this ,act shall be construed to supersede any statute or other provision of law of a ,state or political subdivision of a ,state concerning the use of authorized law enforcement practices and procedures4 7l7 ,regulatory authority ,nothing in this ,act shall be construed-- 7#a7 to authorize the promulgation of any regulations not specifically authorized by this ,act2 7#b7 to establish or limit any regulatory authority not specifically established or limited under this ,act2 or 7#c7 to authorize regulatory actions that would duplicate or conflict with regulatory requirements1 mandatory standards1 or related processes under another provision of ,federal law4 7m7 ,authority of ,secretary of ,defense ,to respond to cyber attacks ,nothing in this ,act shall be construed to limit the authority of the ,secretary of ,defense to develop1 prepare1 coordinate1 or1 when authorized by the ,president to do so1 conduct a military cyber operation in response to a malicious cyber activity carried out against the ,united ,states or a ,united ,states person by a foreign government or an organization sponsored by a foreign government or a terrorist organization4 #i4 ,report on cybersecurity threats 7a7 ,report required ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of ,national ,intelligence1 in coordination with the heads of other appropriate elements of the intelligence community1 shall submit to the ,select ,committee on ,intelligence of the ,senate and the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives a report on cybersecurity threats1 including cyber attacks1 theft1 and data breaches4 7b7 ,contents ,the report required by subsection 7a7 shall include the following3 7#a7 ,an assessment of the current intelligence sharing and cooperation relationships of the ,united ,states with other countries regarding cybersecurity threats1 including cyber attacks1 theft1 and data breaches1 directed against the ,united ,states and which threaten the ,united ,states national security interests and economy and intellectual property1 specifically identifying the relative utility of such relationships1 which elements of the intelligence community participate in such relationships1 and whether and how such relationships could be improved4 7#b7 ,a list and an assessment of the countries and nonstate actors that are the primary threats of carrying out a cybersecurity threat1 including a cyber attack1 theft1 or data breach1 against the ,united ,states and which threaten the ,united ,states national security1 economy1 and intellectual property4 7#c7 ,a description of the extent to which the capabilities of the ,united ,states ,government to respond to or prevent cybersecurity threats1 including cyber attacks1 theft1 or data breaches1 directed against the ,united ,states private sector are degraded by a delay in the prompt notification by private entities of such threats or cyber attacks1 theft1 and breaches4 7#d7 ,an assessment of additional technologies or capabilities that would enhance the ability of the ,united ,states to prevent and to respond to cybersecurity threats1 including cyber attacks1 theft1 and data breaches4 7#e7 ,an assessment of any technologies or practices utilized by the private sector that could be rapidly fielded to assist the intelligence community in preventing and responding to cybersecurity threats4 7c7 ,form of report ,the report required by subsection 7a7 shall be made available in classified and unclassified forms4 7d7 ,intelligence community defined ,in this section1 the term intelligence community has the meaning given that term in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc74 #aj4 ,conforming amendments 7a7 ,public information ,section #eeb7;b7 of title #e1 ,united ,states ,code1 is amended-- 7#a7 in paragraph 7#h71 by striking or at the end2 7#b7 in paragraph 7#i71 by striking wells4 and inserting wells2 or2 and 7#c7 by inserting after paragraph 7#i7 the following3 7#aj7 information shared with or provided to the ,federal ,government pursuant to the ,cybersecurity ,information ,sharing ,act of #bjae4 4 7b7 ,modification of limitation on dissemination of certain information concerning penetrations of defense contractor networks ,section #ida7;c77#c7 of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjac 7,public ,law #aab-bci2 #aj ,u4,s4,c4 #bbbd note7 is amended by inserting at the end the following3 ,the ,secretary may share such information with other ,federal entities if such information consists of cyber threat indicators and defensive measures and such information is shared consistent with the policies and procedures promulgated by the ,attorney ,general under section #e of the ,cybersecurity ,information ,sharing ,act of #bjae44 ,march #ag1 #bjae,read twice and placed on the calendar