,,ii #aaeth ,,congress #ast ,session ,s4 #aaeg ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,may #ag1 #bjag ,mr4 ,schatz 7for himself1 ,mr4 ,johnson1 and ,mr4 ,gardner7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to establish the ,vulnerability ,equities ,review ,board1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,protecting ,our ,ability to ,counter ,hacking ,act of #bjag or ,,patch ,act of #bjag4 #b4 ,vulnerability ,equities ,review ,board 7a7 ,definitions ,in this section3 7#a7 ,federal agency ,the term ,federal agency has the meaning given such term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,publicly known 7,a7 ,in general ,except as provided in subparagraph 7,b71 the term publicly known1 with respect to information regarding a vulnerability1 means information that-- 7i7 is-- 7,i7 a verbal or electronic presentation or discussion in a publicly accessible domain2 or 7,,ii7 in a paper or other published documentation in the public domain2 and 7ii7 that specifically discusses the vulnerability and how the vulnerability could be exploited4 7,b7 ,classified material ,information about a vulnerability shall not be considered publicly known if the information is currently protected as classified and has been inappropriately released to the public4 7#c7 ,vendor ,the term vendor1 with respect to a technology1 product1 system1 service1 or application1 means the person who-- 7,a7 developed the technology1 product1 system1 service1 or application2 or 7,b7 is responsible for maintaining the technology1 product1 system1 service1 or application4 7#d7 ,vulnerability ,the term vulnerability means a design1 configuration1 or implementation weakness in a technology1 product1 system1 service1 or application that can be exploited or triggered to cause unexpected or unintended behavior4 7b7 ,establishment ,there is established the ,vulnerability ,equities ,review ,board 7in this section the ,board74 7c7 ,membership 7#a7 ,permanent members ,the permanent members of the ,board consist of the following3 7,a7 ,the ,secretary of ,homeland ,security1 or the designee of the ,secretary1 who shall be the chair of the ,board4 7,b7 ,the ,director of the ,federal ,bureau of ,investigation1 or the designee of the ,director4 7,c7 ,the ,director of ,national ,intelligence1 or the designee of the ,director4 7,d7 ,the ,director of the ,central ,intelligence ,agency1 or the designee of the ,director4 7,e7 ,the ,director of the ,national ,security ,agency1 or the designee of the ,director4 7,f7 ,the ,secretary of ,commerce1 or the designee of the ,secretary4 7#b7 ,ad hoc members ,the ,board shall include as members1 on an ad hoc basis1 the following3 7,a7 ,the ,secretary of ,state1 or the designee of the ,secretary1 when the ,board considers matters under the jurisdiction of such secretary4 7,b7 ,the ,secretary of the ,treasury1 or the designee of the ,secretary1 when the ,board considers matters under the jurisdiction of such secretary4 7,c7 ,the ,secretary of ,energy1 or the designee of the ,secretary1 when the ,board considers matters under the jurisdiction of such secretary4 7,d7 ,the ,federal ,trade ,commission1 or the designee of the ,commission1 when the ,board considers matters relating to the ,commission4 7#c7 ,other participants ,any member of the ,national ,security ,council under section #aja of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjba7 who is not a permanent or ad hoc member of the ,board may1 with the approval of the ,president1 participate in activities of the ,board when requested by the ,board4 7d7 ,duties 7#a7 ,policies 7,a7 ,in general ,the ,board shall establish policies on matters relating to whether1 when1 how1 to whom1 and to what degree information about a vulnerability that is not publicly known should be shared or released by the ,federal ,government to a non-,federal entity4 7,b7 ,availability to the public ,to the degree that the policies established under subparagraph 7,a7 are unclassified1 the ,board shall make such policies available to the public4 7,c7 ,draft policies 7i7 ,submittal to ,congress 7,i7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,board shall submit to ,congress and the ,president a draft of the policies required by subparagraph 7,a71 along with a description of any challenges or impediments that may require legislative or administrative action4 7,,ii7 ,form ,the draft submitted under subclause 7,i7 shall be in unclassified form1 but may include a classified annex4 7ii7 ,publication ,not later than #bdj days after the date of the enactment of this ,act1 the ,board shall make available to the public a draft of the policies required by subparagraph 7,a71 to the degree that such policies are unclassified4 7#b7 ,requirement ,the head of each ,federal agency shall1 upon obtaining information about a vulnerability that is not publicly known1 subject such information to the process established under paragraph 7#c77;,a74 7#c7 ,process 7,a7 ,in general ,the ,board shall establish the process by which the ,board determines whether1 when1 how1 to whom1 and to what degree the ,federal ,government shares or releases information to a non-,federal entity about a vulnerability that is not publicly known4 7,b7 ,considerations ,the process established under subparagraph 7,a7 shall include1 with respect to a vulnerability1 consideration of the following3 7i7 ,which technologies1 products1 systems1 services1 or applications are subject to the vulnerability1 including whether the products or systems are used in core ,internet infrastructure1 in other critical infrastructure systems1 in the ,united ,states economy1 or in national security systems4 7ii7 ,the potential risks of leaving the vulnerability unpatched or unmitigated4 7iii7 ,the harm that could occur if an actor1 such as an adversary of the ,united ,states or a criminal organization1 were to obtain information about the vulnerability4 7iv7 ,how likely it is that the ,federal ,government would know if someone external to the ,federal ,government were exploiting the vulnerability4 7v7 ,the need of the ,federal ,government to exploit the vulnerability4 7vi7 ,whether the vulnerability is needed for a specific ongoing intelligence or national security operation4 7vii7 ,if a ,federal entity would like to exploit the vulnerability to obtain information1 whether there are other means available to the ,federal entity to obtain such information4 7viii7 ,the likelihood that a non-,federal entity will discover the vulnerability4 7ix7 ,the risks to foreign countries and the people of foreign countries of not sharing or releasing information about the vulnerability4 7x7 ,whether the vulnerability can be patched or otherwise mitigated4 7xi7 ,whether the affected non-,federal entity has a publicly disclosed policy for reporting and disclosing vulnerabilities4 7#d7 ,exclusion from process of vulnerabilities presumptively shareable or releasable 7,a7 ,in general ,under guidelines established by the ,board1 a ,federal agency may share or release information to a non-,federal entity about a vulnerability without subjecting such information to the process under paragraph 7#c77;,a7 if the agency determines that such information is presumptively shareable or releasable4 ,the guidelines shall specify the standards to be used to determine whether or not information is presumptively shareable or releasable for purposes of this paragraph4 7,b7 ,rule of construction ,subparagraph 7,a7 shall not be construed to imply that information which is determined under such subparagraph to be presumptively shareable or releasable is exempt from the requirements of subparagraph 7,a7 of paragraph 7#e7 or the sharing process established under subparagraph 7,b7 of such paragraph4 7#e7 ,dissemination of information on vulnerabilities 7,a7 ,sharing through ,secretary of ,homeland ,security 7i7 ,in general ,in any case in which the ,board determines under paragraph 7#c77;,a7 that information about a vulnerability not otherwise publicly known should be shared with or released to an appropriate vendor1 the ,board shall provide the information to the ,secretary of ,homeland ,security and the ,secretary shall1 on behalf of the ,federal ,government1 share or release the information as directed by the ,board4 7ii7 ,presumptively shareable or releasable information ,in any case in which a ,federal agency determines under paragraph 7#d77;,a7 that information about a vulnerability is presumptively shareable or releasable1 the ,federal agency shall provide such information to the ,secretary and the ,secretary shall1 on behalf of the ,federal ,government1 share or release the information4 7,b7 ,sharing process 7i7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary of ,homeland ,security1 in coordination with the ,secretary of ,commerce1 shall establish the process by which the ,secretary of ,homeland ,security shares or releases information pursuant to subparagraph 7,a74 7ii7 ,use of voluntary consensus standards ,the ,secretary shall ensure that 7,i7 any sharing or release of information under subparagraph 7,a7 is made in accordance with voluntary consensus standards for disclosure of vulnerabilities2 and 7,,ii7 the process established under clause 7i7 is consistent with such standards4 7,c7 ,information not determined to be shareable or releasable 7i7 ,in general ,the policies under paragraph 7#a7 shall provide for-- 7,i7 the periodic review of vulnerabilities that are determined by the ,board1 pursuant to the process established under paragraph 7#c77;,a71 not to be shareable or releasable1 in order to determine whether such vulnerabilities may be shared or released in a manner consistent with the national security interests of the ,united ,states2 and 7,,ii7 the sharing with or releasing to appropriate non-,federal entities of information about vulnerabilities that may be shared or released in a manner consistent with the national security interests of the ,united ,states following review under subclause 7,i74 7ii7 ,in case of later becoming publicly known 7,i7 ,in general ,in the case of a vulnerability that was not publicly known and determined not to be shareable or releasable pursuant to clause 7i77,i7 and then subsequently becomes publicly known1 the vulnerability shall not be subject to the process established under paragraph 7#c77;,a7 and shall be subject to such other ,federal procedures and inter-agency operation processes as may be applicable1 such as procedures and processes established to carry out the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq474 7,,ii7 ,applicability to classified material ,in this clause1 subparagraph 7,b7 of subsection 7a77#b7 shall not apply4 7e7 ,compliance ,each head of a ,federal agency shall ensure that the agency complies with the policies issued by the ,board under this section4 7f7 ,oversight 7#a7 ,annual reports by ,board 7,a7 ,in general ,not less frequently than once each year1 the ,board shall submit to the appropriate committees of ,congress a report on the activities of the ,board and the policies issued under subsection 7d74 7,b7 ,contents ,in addition to information about the activities and policies described in subparagraph 7,a71 the report required by such subparagraph shall also include the following3 7i7 ,the frequency of meetings held by the ,board4 7ii7 ,the aggregate number of vulnerabilities reviewed by the ,board4 7iii7 ,the number of vulnerabilities determined by the ,board to be shareable or releasable4 7iv7 ,the number of vulnerabilities determined by the ,board not to be shareable or releasable4 7v7 ,such other matters as the ,board considers appropriate4 7,c7 ,availability to the public ,for each report submitted under subparagraph 7,a71 the ,board shall make an unclassified version of the report available to the public4 7#b7 ,annual reports on activities of ,i,gs 7,a7 ,in general ,not less frequently than once each year1 the ,inspector ,general of the ,department of ,homeland ,security shall1 in consultation with the ,inspectors ,general of other ,federal agencies whose work is affected by activities of the ,board1 submit to the appropriate committees of ,congress a report on the activities of all such ,inspectors ,general during the preceding year in connection with the activities of the ,board1 the policies issued under subsection 7d71 and the sharing and releasing of information about vulnerabilities pursuant to such policies4 7,b7 ,availability to the public ,for each report submitted under subparagraph 7,a71 the ,inspector ,general of the ,department of ,homeland ,security shall make an unclassified version of the report available to the public4 7#c7 ,form ,each report under paragraphs 7#a7 and 7#b7 shall be submitted in unclassified form1 but may include a classified annex4 7#d7 ,review by ,privacy and ,civil ,liberties ,oversight ,board 7,a7 ,in general ,the ,privacy and ,civil ,liberties ,oversight ,board shall review each report submitted under paragraph 7#a74 7,b7 ,consultation ,the ,vulnerability ,equities ,review ,board may consult with the ,privacy and ,civil ,liberties ,oversight ,board as the ,vulnerability ,equities ,review ,board considers appropriate4 7#e7 ,appropriate committees of ,congress defined ,in this subsection1 the term appropriate committees of ,congress means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs1 the ,committee on ,commerce1 ,science1 and ,transportation1 and the ,select ,committee on ,intelligence of the ,senate2 and 7,b7 the ,committee on ,homeland ,security1 the ,committee on ,oversight and ,government ,reform1 the ,committee on ,energy and ,commerce1 and the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives4