,,ib ,union ,calendar ,no4 #ceg #aaeth ,,congress #b;d ,session ,h4 ,r4 #cggf ,report ,no4 #aae-dhc ,,in ,,the ,,house ,,of ,,representatives ,september #ad1 #bjag ,mr4 ,royce of ,california 7for himself1 ,mr4 ,engel1 ,mr4 ,mc,caul1 ,mr4 ,ted ,lieu of ,california1 ,mr4 ,fitzpatrick1 ,mrs4 ,dingell1 ,mr4 ,poe of ,texas1 ,mr4 ,ruppersberger1 ,mr4 ,yoho1 ,mr4 ,langevin1 ,mrs4 ,wagner1 and ,mr4 ,brendan ,f4 ,boyle of ,pennsylvania7 introduced the following bill2 which was referred to the ,committee on ,foreign ,affairs ,january #c1 #bjah ,additional sponsors3 ,mr4 ,chabot1 ,mr4 ,connolly1 ,ms4 ,rosen1 ,mr4 ,himes1 ,mr4 ,kinzinger1 ,mr4 ,sherman1 ,mr4 ,graves of ,georgia1 ,mr4 ,meadows1 ,mr4 ,francis ,rooney of ,florida1 ,mr4 ,marino1 ,mr4 ,cicilline1 ,ms4 ,frankel of ,florida1 ,mr4 ,wilson of ,south ,carolina1 and ,mrs4 ,murphy of ,florida ,january #c1 #bjah ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed ,strike out all after the enacting clause and insert the part printed in italic ,for text of introduced bill1 see copy of bill as introduced on ,september #ad1 #bjag ,a ,,bill ,to support ,united ,states international cyber diplomacy1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cyber ,diplomacy ,act of #bjag4 #b4 ,findings ,congress finds the following3 7#a7 ,the stated goal of the ,united ,states ,international ,strategy for ,cyberspace1 launched on ,may #af1 #bjaa1 is to work internationally to promote an open1 interoperable1 secure1 and reliable information and communications infrastructure that supports international trade and commerce1 strengthens international security1 and fosters free expression and innovation ''' in which norms of responsible behavior guide ,states' actions1 sustain partnerships1 and support the rule of law in cyberspace44 7#b7 ,the ,group of ,governmental ,experts 7,,gge7 on ,developments in the ,field of ,information and ,telecommunications in the ,context of ,international ,security1 established by the ,united ,nations ,general ,assembly1 concluded in its ,june #bd1 #bjac1 report that ,state sovereignty and the international norms and principles that flow from it apply to ,states' conduct of information and communications technology or ,,ict related activities and to their jurisdiction over ,,ict infrastructure with their territory44 7#c7 ,on ,january #ac1 #bjae1 ,china1 ,kazakhstan1 ,kyrgyzstan1 ,russia1 ,tajikistan1 and ,uzbekistan proposed a troubling international code of conduct for information security which defines responsible ,state behavior in cyberspace to include curbing the dissemination of information and the right to independent control of information and communications technology when a country's political security is threatened4 7#d7 ,the ,july #bb1 #bjae1 ,,gge consensus report found that1 norms of responsible ,state behavior can reduce risks to international peace1 security and stability44 7#e7 ,on ,september #be1 #bjae1 the ,united ,states and ,china announced a commitment that neither country's government will conduct or knowingly support cyber-enabled theft of intellectual property1 including trade secrets or other confidential business information1 with the intent of providing competitive advantages to companies or commercial sectors44 7#f7 ,at the ,antalya ,summit from ,november #ae-af1 #bjae1 the ,group of #bj 7,g#bj7 ,leaders' ,communique affirmed the applicability of international law to ,state behavior in cyberspace1 called on ,states to refrain from cyber-enabled theft of intellectual property for commercial gain1 and endorsed the view that all ,states should abide by norms of responsible behavior4 7#g7 ,the ,march #bjaf ,department of ,state ,international ,cyberspace ,policy ,strategy noted that1 the ,department of ,state anticipates a continued increase and expansion of our cyber-focused diplomatic efforts for the foreseeable future44 7#h7 ,on ,december #a1 #bjaf1 the ,commission on ,enhancing ,national ,cybersecurity established within the ,department of ,commerce recommended the ,president should appoint an ,ambassador for ,cybersecurity to lead ,u4,s4 engagement with the international community on cybersecurity strategies1 standards1 and practices44 7#i7 ,the #bjag ,group of #g 7,g#g7 ,declaration on ,responsible ,states ,behavior in ,cyberspace recognized on ,april #aa1 #bjag1 the urgent necessity of increased international cooperation to promote security and stability in cyberspace ''' consisting of the applicability of existing international law to ,state behavior in cyberspace1 the promotion of voluntary1 non-binding norms of responsible ,state behavior during peacetime and reaffirmed that the same rights that people have offline must also be protected online44 7#aj7 ,in testimony before the ,select ,committee on ,intelligence of the ,senate on ,may #aa1 #bjag1 the ,director of ,national ,intelligence identified six cyber threat actors1 including ,russia for efforts to influence the #bjaf ,,us election2 ,china1 for actively targeting the ,,us ,government1 its allies1 and ,,us companies for cyber espionage2 ,iran for leverageing cyber espionage1 propaganda1 and attacks to support its security priorities1 influence events and foreign perceptions1 and counter threats2 ,north ,korea for previously conducting cyber-attacks against ,,us commercial entities--specifically1 ,sony ,pictures ,entertainment in #bjad2 terrorists1 who use the ,internet to organize1 recruit1 spread propaganda1 raise funds1 collect intelligence1 inspire action by followers1 and coordinate operations2 and criminals who are also developing and using sophisticated cyber tools for a variety of purposes including theft1 extortion1 and facilitation of other criminal activities4 7#aa7 ,on ,may #aa1 #bjag1 ,president ,trump issued ,presidential ,executive ,order #achjj on ,strengthening the ,cybersecurity of ,federal ,networks and ,infrastructure which designated the ,secretary of ,state to lead an interagency effort to develop strategic options for the ,president to deter adversaries from cyber threats and an engagement strategy for international cooperation in cybersecurity1 noting that the ,united ,states is especially dependent on a globally secure and resilient internet and must work with allies and other partners toward maintaining the policy of the executive branch to promote an open1 interoperable1 reliable1 and secure internet that fosters efficiency1 innovation1 communication1 and economic prosperity1 while respecting privacy and guarding against deception1 fraud1 and theft44 #c4 ,united ,states international cyberspace policy 7a7 ,in general ,congress declares that it is the policy of the ,united ,states to work internationally with allies and other partners to promote an open1 interoperable1 reliable1 unfettered1 and secure internet governed by the multistakeholder model which promotes human rights1 democracy1 and rule of law1 including freedom of expression1 innovation1 communication1 and economic prosperity1 while respecting privacy and guarding against deception1 fraud1 and theft4 7b7 ,implementation ,in implementing the policy described in subsection 7a71 the ,president1 in consultation with outside actors1 including technology companies1 nongovernmental organizations1 security researchers1 and other relevant stakeholders1 shall pursue the following objectives in the conduct of bilateral and multilateral relations3 7#a7 ,clarifying the applicability of international laws and norms1 including the law of armed conflict1 to the use of ,,ict4 7#b7 ,clarifying that countries that fall victim to malicious cyber activities have the right to take proportionate countermeasures under international law1 provided such measures do not violate a fundamental human right or peremptory norm4 7#c7 ,reducing and limiting the risk of escalation and retaliation in cyberspace1 such as massive denial-of-service attacks1 damage to critical infrastructure1 or other malicious cyber activity that impairs the use and operation of critical infrastructure that provides services to the public4 7#d7 ,cooperating with like-minded democratic countries that share common values and cyberspace policies with the ,united ,states1 including respect for human rights1 democracy1 and rule of law1 to advance such values and policies internationally4 7#e7 ,securing and implementing commitments on responsible country behavior in cyberspace based upon accepted norms1 including the following3 7,a7 ,countries should not conduct or knowingly support cyber-enabled theft of intellectual property1 including trade secrets or other confidential business information1 with the intent of providing competitive advantages to companies or commercial sectors4 7,b7 ,countries should cooperate in developing and applying measures to increase stability and security in the use of ,i,c,ts and to prevent ,,ict practices that are acknowledged to be harmful or that may pose threats to international peace and security4 7,c7 ,countries should take all appropriate and reasonable efforts to keep their territories clear of intentionally wrongful acts using ,i,c,ts in violation of international commitments4 7,d7 ,countries should not conduct or knowingly support ,,ict activity that1 contrary to international law1 intentionally damages or otherwise impairs the use and operation of critical infrastructure1 and should take appropriate measures to protect their critical infrastructure from ,,ict threats4 7,e7 ,countries should not conduct or knowingly support malicious international activity that1 contrary to international law1 harms the information systems of authorized emergency response teams 7sometimes known as computer emergency response teams or cybersecurity incident response teams7 or related private sector companies of another country4 7,f7 ,countries should identify economic drivers and incentives to promote securely-designed ,,ict products and to develop policy and legal frameworks to promote the development of secure internet architecture4 7,g7 ,countries should respond to appropriate requests for assistance to mitigate malicious ,,ict activity aimed at the critical infrastructure of another country emanating from their territory4 7,h7 ,countries should not restrict cross-border data flows or require local storage or processing of data4 7,i7 ,countries should protect the exercise of human rights and fundamental freedoms on the ,internet and commit to the principle that the human rights that people have offline enjoy the same protections online4 #d4 ,department of ,state responsibilities 7a7 ,office of ,cyber ,issues ,section #a of the ,state ,department ,basic ,authorities ,act of #aief 7#bb ,u4,s4,c4 #bfea;a7 is amended-- 7#a7 by redesignating subsection 7g7 as subsection 7h72 and 7#b7 by inserting after subsection 7f7 the following new subsection3 7g7 ,office of ,cyber ,issues 7#a7 ,in general ,there is established an ,office of ,cyber ,issues 7in this subsection referred to as the ,office74 ,the head of the ,office shall have the rank and status of ambassador and be appointed by the ,president1 by and with the advice and consent of the ,senate4 7#b7 ,duties 7,a7 ,in general ,the head of the ,office shall perform such duties and exercise such powers as the ,secretary of ,state shall prescribe1 including implementing the policy of the ,united ,states described in section #c of the ,cyber ,diplomacy ,act of #bjag4 7,b7 ,duties described ,the principal duties of the head of the ,office shall be to-- 7i7 serve as the principal cyber-policy official within the senior management of the ,department of ,state and advisor to the ,secretary of ,state for cyber issues2 7ii7 lead the ,department of ,state's diplomatic cyberspace efforts generally1 including relating to international cybersecurity1 internet access1 internet freedom1 digital economy1 cybercrime1 deterrence and international responses to cyber threats2 7iii7 promote an open1 interoperable1 reliable1 unfettered1 and secure information and communications technology infrastructure globally2 7iv7 represent the ,secretary of ,state in interagency efforts to develop and advance the ,united ,states international cyberspace policy2 7v7 coordinate within the ,department of ,state and with other components of the ,united ,states ,government cyberspace efforts and other relevant functions1 including countering terrorists' use of cyberspace2 and 7vi7 act as liaison to public and private sector entities on relevant cyberspace issues4 7#c7 ,qualifications ,the head of the ,office should be an individual of demonstrated competency in the field of-- 7,a7 cybersecurity and other relevant cyber issues2 and 7,b7 international diplomacy4 7#d7 ,organizational placement ,the head of the ,office shall report to the ,under ,secretary for ,political ,affairs or official holding a higher position in the ,department of ,state4 7#e7 ,rule of construction ,nothing in this subsection may be construed as precluding-- 7,a7 the ,office from being elevated to a ,bureau of the ,department of ,state2 and 7,b7 the head of the ,office from being elevated to an ,assistant ,secretary1 if such an ,assistant ,secretary position does not increase the number of ,assistant ,secretary positions at the ,department above the number authorized under subsection 7c77#a74 4 7b7 ,sense of ,congress ,it is the sense of ,congress that the ,office of ,cyber ,issues established under section #a7;g7 of the ,state ,department ,basic ,authorities ,act of #aief 7as amended by subsection 7a7 of this section7 should be a ,bureau of the ,department of ,state headed by an ,assistant ,secretary1 subject to the rule of construction specified in paragraph 7#e77;,b7 of such section #a7;g74 7c7 ,united ,nations ,the ,permanent ,representative of the ,united ,states to the ,united ,nations shall use the voice1 vote1 and influence of the ,united ,states to oppose any measure that is inconsistent with the ,united ,states international cyberspace policy described in section #c4 #e4 ,international cyberspace executive arrangements 7a7 ,in general ,the ,president is encouraged to enter into executive arrangements with foreign governments that support the ,united ,states international cyberspace policy described in section #c4 7b7 ,transmission to ,congress ,the text of any executive arrangement 7including the text of any oral arrangement1 which shall be reduced to writing7 entered into by the ,united ,states under subsection 7a7 shall be transmitted to the ,committee on ,foreign ,affairs of the ,house of ,representatives and the ,committee on ,foreign ,relations of the ,senate not later than five days after such arrangement is signed or otherwise agreed to1 together with an explanation of such arrangement1 its purpose1 how such arrangement is consistent with the ,united ,states international cyberspace policy described in section #c1 and how such arrangement will be implemented4 7c7 ,status report ,not later than one year after the text of an executive arrangement is transmitted to ,congress pursuant to subsection 7b7 and annually thereafter for seven years1 or until such an arrangement has been discontinued1 the ,president shall report to the ,committee on ,foreign ,affairs of the ,house of ,representatives and the ,committee on ,foreign ,relations of the ,senate on the status of such arrangement1 including an evidence-based assessment of whether all parties to such arrangement have fulfilled their commitments under such arrangement and if not1 what steps the ,united ,states has taken or plans to take to ensure all such commitments are fulfilled1 whether the stated purpose of such arrangement is being achieved1 and whether such arrangement positively impacts building of cyber norms internationally4 ,each such report shall include metrics to support its findings4 7d7 ,existing executive arrangements ,not later than #fj days after the date of the enactment of this ,act1 the ,president shall satisfy the requirements of subsection 7c7 for the following executive arrangements already in effect3 7#a7 ,the arrangement announced between the ,united ,states and ,japan on ,april #be1 #bjad4 7#b7 ,the arrangement announced between the ,united ,states and the ,united ,kingdom on ,january #af1 #bjae4 7#c7 ,the arrangement announced between the ,united ,states and ,china on ,september #be1 #bjae4 7#d7 ,the arrangement announced between the ,united ,states and ,korea on ,october #af1 #bjae4 7#e7 ,the arrangement announced between the ,united ,states and ,australia on ,january #ai1 #bjaf4 7#f7 ,the arrangement announced between the ,united ,states and ,india on ,june #g1 #bjaf4 7#g7 ,the arrangement announced between the ,united ,states and ,argentina on ,april #bg1 #bjag4 7#h7 ,the arrangement announced between the ,united ,states and ,kenya on ,june #bb1 #bjag4 7#i7 ,the arrangement announced between the ,united ,states and ,israel on ,june #bf1 #bjag4 7#aj7 ,any other similar bilateral or multilateral arrangement announced before the date of the enactment of this ,act4 #f4 ,international strategy for cyberspace 7a7 ,strategy required ,not later than one year after the date of the enactment of this ,act1 the ,secretary of ,state1 in coordination with the heads of other relevant ,federal departments and agencies1 shall produce a strategy relating to ,united ,states international policy with regard to cyberspace4 7b7 ,elements ,the strategy required under subsection 7a7 shall include the following3 7#a7 ,a review of actions and activities undertaken to support the ,united ,states international cyberspace policy described in section #c4 7#b7 ,a plan of action to guide the diplomacy of the ,department of ,state with regard to foreign countries1 including conducting bilateral and multilateral activities to develop the norms of responsible international behavior in cyberspace1 and status review of existing efforts in multilateral fora to obtain agreements on international norms in cyberspace4 7#c7 ,a review of alternative concepts with regard to international norms in cyberspace offered by foreign countries4 7#d7 ,a detailed description of new and evolving threats to ,united ,states national security in cyberspace from foreign countries1 ,state-sponsored actors1 and private actors to ,federal and private sector infrastructure of the ,united ,states1 intellectual property in the ,united ,states1 and the privacy of citizens of the ,united ,states4 7#e7 ,a review of policy tools available to the ,president to deter and de-escalate tensions with foreign countries1 ,state-sponsored actors1 and private actors regarding threats in cyberspace1 and to what degree such tools have been used and whether or not such tools have been effective4 7#f7 ,a review of resources required to conduct activities to build responsible norms of international cyber behavior4 7#g7 ,a clarification of the applicability of international laws and norms1 including the law of armed conflict1 to the use of ,,ict4 7#h7 ,a clarification that countries that fall victim to malicious cyber activities have the right to take proportionate countermeasures under international law1 including exercising the right to collective and individual self-defense4 7#i7 ,a plan of action to guide the diplomacy of the ,department of ,state with regard to existing mutual defense agreements1 including the inclusion in such agreements of information relating to the applicability of malicious cyber activities in triggering mutual defense obligations4 7c7 ,form of strategy 7#a7 ,public availability ,the strategy required under subsection 7a7 shall be available to the public in unclassified form1 including through publication in the ,federal ,register4 7#b7 ,classified annex 7,a7 ,in general ,if the ,secretary of ,state determines that such is appropriate1 the strategy required under subsection 7a7 may include a classified annex consistent with ,united ,states national security interests4 7,b7 ,rule of construction ,nothing in this subsection may be construed as authorizing the public disclosure of an unclassified annex under subparagraph 7,a74 7d7 ,briefing ,not later than #cj days after the production of the strategy required under subsection 7a71 the ,secretary of ,state shall brief the ,committee on ,foreign ,affairs of the ,house of ,representatives and the ,committee on ,foreign ,relations of the ,senate on such strategy1 including any material contained in a classified annex4 7e7 ,updates ,the strategy required under subsection 7a7 shall be updated-- 7#a7 not later than #ij days after there has been any material change to ,united ,states policy as described in such strategy2 and 7#b7 not later than one year after each inauguration of a new ,president4 7f7 ,preexisting requirement ,upon the production and publication of the report required under section #c7;c7 of the ,presidential ,executive ,order #achjj on ,strengthening the ,cybersecurity of ,federal ,networks and ,critical ,infrastructure on ,may #aa1 #bjag1 such report shall be considered as satisfying the requirement under subsection 7a7 of this section4 #g4 ,annual country reports on human rights practices 7a7 ,report relating to economic assistance ,section #aaf of the ,foreign ,assistance ,act of #aifa 7#bb ,u4,s4,c4 #baean7 is amended by adding at the end the following new subsection3 7h7 7#a7 ,the report required by subsection 7d7 shall include an assessment of freedom of expression with respect to electronic information in each foreign country4 ,such assessment shall consist of the following3 7,a7 ,an assessment of the extent to which government authorities in each country inappropriately attempt to filter1 censor1 or otherwise block or remove nonviolent expression of political or religious opinion or belief via the internet1 including electronic mail1 as well as a description of the means by which such authorities attempt to block or remove such expression4 7,b7 ,an assessment of the extent to which government authorities in each country have persecuted or otherwise punished an individual or group for the nonviolent expression of political1 religious1 or ideological opinion or belief via the internet1 including electronic mail4 7,c7 ,an assessment of the extent to which government authorities in each country have sought to inappropriately collect1 request1 obtain1 or disclose personally identifiable information of a person in connection with such person's nonviolent expression of political1 religious1 or ideological opinion or belief1 including expression that would be protected by the ,international ,covenant on ,civil and ,political ,rights4 7,d7 ,an assessment of the extent to which wire communications and electronic communications are monitored without regard to the principles of privacy1 human rights1 democracy1 and rule of law4 7#b7 ,in compiling data and making assessments for the purposes of paragraph 7#a71 ,united ,states diplomatic personnel shall consult with human rights organizations1 technology and internet companies1 and other appropriate nongovernmental organizations4 7#c7 ,in this subsection-- 7,a7 the term electronic communication has the meaning given such term in section #beaj of title #ah1 ,united ,states ,code2 7,b7 the term internet has the meaning given such term in section #bca7;e77#c7 of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bca7;e77#c772 7,c7 the term personally identifiable information means data in a form that identifies a particular person2 and 7,d7 the term wire communication has the meaning given such term in section #beaj of title #ah1 ,united ,states ,code4 4 7b7 ,report relating to security assistance ,section #ejb;,b of the ,foreign ,assistance ,act of #aifa 7#bb ,u4,s4,c4 #bcjd7 is amended-- 7#a7 by redesignating the second subsection 7i7 7relating to child marriage status7 as subsection 7j72 and 7#b7 by adding at the end the following new subsection3 7k7 7#a7 ,the report required by subsection 7b7 shall include an assessment of freedom of expression with respect to electronic information in each foreign country4 ,such assessment shall consist of the following3 7,a7 ,an assessment of the extent to which government authorities in each country inappropriately attempt to filter1 censor1 or otherwise block or remove nonviolent expression of political or religious opinion or belief via the internet1 including electronic mail1 as well as a description of the means by which such authorities attempt to block or remove such expression4 7,b7 ,an assessment of the extent to which government authorities in each country have persecuted or otherwise punished an individual or group for the nonviolent expression of political1 religious1 or ideological opinion or belief via the internet1 including electronic mail4 7,c7 ,an assessment of the extent to which government authorities in each country have sought to inappropriately collect1 request1 obtain1 or disclose personally identifiable information of a person in connection with such person's nonviolent expression of political1 religious1 or ideological opinion or belief1 including expression that would be protected by the ,international ,covenant on ,civil and ,political ,rights4 7,d7 ,an assessment of the extent to which wire communications and electronic communications are monitored without regard to the principles of privacy1 human rights1 democracy1 and rule of law4 7#b7 ,in compiling data and making assessments for the purposes of paragraph 7#a71 ,united ,states diplomatic personnel shall consult with human rights organizations1 technology and internet companies1 and other appropriate nongovernmental organizations4 7#c7 ,in this subsection-- 7,a7 the term electronic communication has the meaning given such term in section #beaj of title #ah1 ,united ,states ,code2 7,b7 the term internet has the meaning given such term in section #bca7;e77#c7 of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bca7;e77#c772 7,c7 the term personally identifiable information means data in a form that identifies a particular person2 and 7,d7 the term wire communication has the meaning given such term in section #beaj of title #ah1 ,united ,states ,code4 4 ,january #c1 #bjah ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed