,,ii #aaeth ,,congress #b;d ,session ,s4 #ccgh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,august #bc1 #bjah ,mr4 ,gardner 7for himself and ,mr4 ,coons7 introduced the following bill2 which was read twice and referred to the ,committee on ,foreign ,relations ,a ,,bill ,to impose sanctions with respect to state-sponsored cyber activities against the ,united ,states1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cyber ,deterrence and ,response ,act of #bjah4 #b4 ,findings ,congress finds the following3 7#a7 ,on ,february #ac1 #bjah1 the ,director of ,national ,intelligence stated in his testimony before the ,select ,committee on ,intelligence of the ,senate that ,russia1 ,china1 ,iran1 and ,north ,korea will pose the greatest cyber threats to the ,united ,states during the next year through the use of cyber operations as low-cost tools of statecraft1 and assessed that those countries would work to use cyber operations to achieve strategic objectives unless they face clear repercussions for their cyber operations4 7#b7 ,the #bjag ,worldwide ,threat ,assessment of the ,united ,states intelligence community stated1 ,the potential for surprise in the cyber realm will increase in the next year and beyond as billions more digital devices are connected--with relatively little built-in security--and both nation states and malign actors become more emboldened and better equipped in the use of increasingly widespread cyber toolkits4 ,the risk is growing that some adversaries will conduct cyber attacks--such as data deletion or localized and temporary disruptions of critical infrastructure--against the ,united ,states in a crisis short of war44 7#c7 ,on ,march #bi1 #bjag1 ,president ,donald ,j4 ,trump deemed it necessary to continue the national emergency declared in ,executive ,order #acfid 7#ej ,u4,s4,c4 #agja note2 relating to blocking the property of certain persons engaging in significant malicious cyber-enabled activities7 as significant malicious cyber-enabled activities originating from1 or directed by persons located1 in whole or in substantial part1 outside the ,united ,states1 continue to pose an unusual and extraordinary threat to the national security1 foreign policy1 and economy of the ,united ,states4 7#d7 ,on ,january #e1 #bjag1 former ,director of ,national ,intelligence ,james ,clapper1 former ,under ,secretary of ,defense for ,intelligence ,marcel ,lettre1 and ,commander of the ,united ,states ,cyber ,command ,admiral ,michael ,rogers1 submitted joint testimony to the ,committee on ,armed ,services of the ,senate that stated that as of late #bjaf more than #cj nations are developing offensive cyber attack capabilities and that protecting critical infrastructure1 such as crucial energy1 financial1 manufacturing1 transportation1 communication1 and health systems1 will become an increasingly complex national security challenge4 7#e7 ,there is significant evidence that hackers affiliated with foreign governments have conducted cyber operations targeting entities and critical infrastructure sectors in the ,united ,states as the ,department of ,justice has announced that-- 7,a7 on ,march #bd1 #bjaf1 #g ,iranians working for entities affiliated with ,iran's ,revolutionary ,guard ,corps were indicted for conducting distributed denial of service attacks against the financial sector in the ,united ,states from #bjab to #bjac2 and 7,b7 on ,may #ai1 #bjad1 #e ,chinese military hackers were charged for hacking ,united ,states entities in the nuclear power1 metals1 and solar products industries and engaging in economic espionage4 7#f7 ,in ,may #bjag1 ,north ,korea released ,wanna,cry pseudo-ransomware1 which posed a significant risk to the economy1 national security1 and the citizens of the ,united ,states and the world1 as it resulted in the infection of more than #cjj1jjj computer systems in more than #aej countries1 including in the healthcare sector of the ,united ,kingdom1 demonstrating the global reach and cost of cyber-enabled malicious activity4 7#g7 ,in ,june #bjag1 the ,russian ,federation carried out the most destructive cyber-enabled operation in history1 releasing the ,not,petya malware that caused billions of dollars' worth of damage within ,ukraine and across ,europe1 ,asia1 and the ,americas4 7#h7 ,on ,may #ca1 #bjah1 the ,department of ,state1 pursuant to section #c7;b7 of ,executive ,order #achjj 7#hb ,fed4 ,reg4 #bbcia2 relating to strengthening the cybersecurity of ,federal networks and critical infrastructure71 issued a document entitled ,recommendations to the ,president on ,deterring ,adversaries and ,better ,protecting the ,american ,people ,from ,cyber ,threats1 which stated1 ,with respect to activities below the threshold of the use of force1 the ,united ,states should1 working with likeminded partners when possible1 adopt an approach of imposing swift1 costly1 and transparent consequences on foreign governments responsible for significant malicious cyber activities aimed at harming ,u4,s4 national interests44 #c4 ,actions to address state-sponsored cyber activities against the ,united ,states 7a7 ,designation as a critical cyber threat actor 7#a7 ,in general ,the ,president1 acting through the ,secretary of ,state1 and in coordination with the heads of other relevant ,federal agencies1 shall designate as a critical cyber threat actor-- 7,a7 each foreign person and each agency or instrumentality of a foreign state that the ,president determines to be knowingly responsible for or complicit in1 or to have knowingly engaged in1 directly or indirectly1 state-sponsored cyber activities that are reasonably likely to result in1 or have contributed to1 a significant threat to the national security1 foreign policy1 or economic health or financial stability of the ,united ,states and that have the purpose or effect of-- 7i7 causing a significant disruption to the availability of a computer or network of computers2 7ii7 harming1 or otherwise significantly compromising the provision of service by1 a computer or network of computers that support one or more entities in a critical infrastructure sector2 7iii7 significantly compromising the provision of services by one or more entities in a critical infrastructure sector2 7iv7 causing a significant misappropriation of funds or economic resources1 trade secrets1 personal identifiers1 or financial information for commercial or competitive advantage or private financial gain2 7v7 destabilizing the financial sector of the ,united ,states by tampering with1 altering1 or causing a misappropriation of data2 or 7vi7 interfering with or undermining election processes or institutions by tampering with1 altering1 or causing misappropriation of data2 7,b7 each foreign person that the ,president determines to have knowingly1 significantly1 and materially assisted1 sponsored1 or provided financial1 material1 or technological support for1 or goods or services to or in support of1 any activities described in subparagraph 7,a7 by a foreign person or agency or instrumentality of a foreign state designated as a critical cyber threat actor under subparagraph 7,a72 and 7,c7 each agency or instrumentality of a foreign state that the ,president determines to have significantly and materially assisted1 sponsored1 or provided financial1 material1 or technological support for1 or goods or services to or in support of1 any activities described in subparagraph 7,a7 by a foreign person or agency or instrumentality of a foreign state designated as a critical cyber threat actor under subparagraph 7,a74 7#b7 ,publication in ,federal ,register 7,a7 ,in general ,the ,president shall-- 7i7 publish in the ,federal ,register a list of each foreign person and each agency or instrumentality of a foreign state designated as a critical cyber threat actor under this subsection2 and 7ii7 regularly update the list not later than #g days after making any changes to the list1 and publish in the ,federal ,register such updates4 7,b7 ,exception 7i7 ,in general ,the ,president may withhold from publication in the ,federal ,register under subparagraph 7,a7 the identification of any foreign person or agency or instrumentality of a foreign state designated as a critical cyber threat actor under this subsection if the ,president determines that withholding such identification-- 7,i7 is important to the national security interests of the ,united ,states2 or 7,,ii7 is for an important law enforcement purpose4 7ii7 ,transmission ,if the ,president exercises the authority under this subparagraph to withhold from publication in the ,federal ,register the identification of a foreign person or agency or instrumentality of a foreign state designated as a critical cyber threat actor under this subsection1 the ,president shall transmit to the appropriate congressional committees in classified form a report containing any such identification1 together with the reasons for exercising such authority4 7b7 ,non-,travel-,related sanctions 7#a7 ,in general ,the ,president shall impose one or more of the applicable sanctions described in paragraph 7#b7 with respect to each foreign person and each agency or instrumentality of a foreign state designated as a critical cyber threat actor under subsection 7a74 7#b7 ,sanctions described ,the sanctions to be imposed under paragraph 7#a7 with respect to a foreign person or an agency or instrumentality of a foreign state designated as a critical cyber threat actor under subsection 7a7 are the following3 7,a7 ,the ,president may provide for the withdrawal1 limitation1 or suspension of ,united ,states security assistance under part ,,ii of the ,foreign ,assistance ,act of #aifa 7#bb ,u4,s4,c4 #bcja et seq47 to or involving the foreign person or agency or instrumentality4 7,b7 ,the ,president may direct the ,united ,states executive director to each international financial institution to use the voice and vote of the ,united ,states to oppose any loan from the international financial institution that would benefit the foreign person or agency or instrumentality4 7,c7 ,the ,president may1 pursuant to such regulations or guidelines as the ,president may prescribe1 prohibit any ,united ,states person from investing in or purchasing significant amounts of equity or debt instruments of the foreign person or agency or instrumentality4 7,d7 ,the ,president may1 pursuant to such regulations or guidelines as the ,president shall prescribe 7which shall include the opportunity to appeal actions under this subparagraph71 prohibit any ,united ,states agency or instrumentality from procuring1 or entering into any contract for the procurement of1 any goods1 technology1 or services1 or classes of goods1 technology1 or services1 from the foreign person or agency or instrumentality4 7,e7 ,the ,president may order the heads of the appropriate ,united ,states agencies to not issue any 7or a specified number of7 specific licenses1 and to not grant any other specific authority 7or a specified number of authorities71 to export1 reexport1 or transfer any goods or technology originating in the ,united ,states to the foreign person or agency or instrumentality under-- 7i7 the ,export ,administration ,act of #aigi 7#ej ,u4,s4,c4 #dfja et seq47 7as continued in effect pursuant the ,international ,emergency ,economic ,powers ,act 7#ej ,u4,s4,c4 #agja et seq477 7or any successor ,act72 7ii7 the ,arms ,export ,control ,act 7#bb ,u4,s4,c4 #bgea et seq472 7iii7 the ,atomic ,energy ,act of #aied 7#db ,u4,s4,c4 #bjaa et seq472 or 7iv7 any other statute that requires the prior review and approval of the ,united ,states ,government as a condition for the export1 reexport1 or transfer of goods or services originating in the ,united ,states4 7,f7 7i7 ,the ,president may exercise all of the powers granted to the ,president under the ,international ,emergency ,economic ,powers ,act 7#ej ,u4,s4,c4 #agja et seq47 7except that the requirements of section #bjb of such ,act 7#ej ,u4,s4,c4 #agja7 shall not apply7 to the extent necessary to block and prohibit all transactions in property and interests in property of the foreign person or agency or instrumentality if such property and interests in property are in the ,united ,states1 come within the ,united ,states1 or are or come within the possession or control of a ,united ,states person4 7ii7 ,the penalties provided for in subsections 7b7 and 7c7 of section #bjf of the ,international ,emergency ,economic ,powers ,act 7#ej ,u4,s4,c4 #agje7 shall apply to a person that violates1 attempts to violate1 conspires to violate1 or causes a violation of regulations prescribed under clause 7i7 to the same extent that such penalties apply to a person that commits an unlawful act described in subsection 7a7 of such section #bjf4 7,g7 ,the ,president may1 pursuant to such regulations as the ,president may prescribe1 prohibit any transfers of credit or payments between one or more financial institutions or by1 through1 or to any financial institution1 to the extent that such transfers or payments are subject to the jurisdiction of the ,united ,states and involve any interest of the foreign person or agency or instrumentality4 7c7 ,travel-,related sanctions 7#a7 ,aliens ineligible for visas1 admission1 or parole ,an alien who is designated as a critical cyber threat actor under subsection 7a7 is-- 7,a7 inadmissible to the ,united ,states2 7,b7 ineligible to receive a visa or other documentation to enter the ,united ,states2 and 7,c7 otherwise ineligible to be admitted or paroled into the ,united ,states or to receive any other benefit under the ,immigration and ,nationality ,act 7#h ,u4,s4,c4 #aaja et seq474 7#b7 ,current visas revoked ,the issuing consular officer1 the ,secretary of ,state1 or the ,secretary of ,homeland ,security 7or a designee of either such ,secretary7 shall revoke any visa or other entry documentation issued to an alien designated as a critical cyber threat actor under subsection 7a7 regardless of when the visa or other documentation is issued4 ,a revocation under this paragraph shall take effect immediately and shall automatically cancel any other valid visa or entry documentation that is in the possession of the alien4 7d7 ,additional sanctions with respect to foreign states 7#a7 ,in general ,the ,president may impose any of the sanctions described in paragraph 7#b7 with respect to a foreign state if the ,president determines that the government of the foreign state aided1 abetted1 or directed a foreign person or agency or instrumentality of a foreign state designated as a critical cyber threat actor under subsection 7a74 7#b7 ,sanctions described ,the sanctions that may be imposed under paragraph 7#a7 with respect to a foreign state are the following3 7,a7 ,the ,president may provide for the withdrawal1 limitation1 or suspension of non-humanitarian or non-trade-related assistance ,united ,states development assistance under chapter #a of part ,i of the ,foreign ,assistance ,act of #aifa 7#bb ,u4,s4,c4 #baea et seq47 to the foreign state4 7,b7 ,the ,president may provide for the withdrawal1 limitation1 or suspension of ,united ,states security assistance under part ,,ii of the ,foreign ,assistance ,act of #aifa 7#bb ,u4,s4,c4 #bcja et seq47 to the foreign state4 7,c7 ,the ,president may instruct the ,united ,states ,executive ,director to each appropriate international financial institution to use the voice and vote of the ,united ,states to oppose the extension by the institution of any loan or financial assistance to the foreign state4 7,d7 ,the ,president may prohibit the exportation to the foreign state of any item on the ,united ,states ,munitions ,list established pursuant to section #ch of the ,arms ,export ,control ,act 7#bb ,u4,s4,c4 #bggh7 or the ,commerce ,control ,list set forth in ,supplement ,no4 #a to part #ggd of title #ae1 ,code of ,federal ,regulations4 7e7 ,implementation ,the ,president may exercise all authorities provided under sections #bjc and #bje of the ,international ,emergency ,economic ,powers ,act 7#ej ,u4,s4,c4 #agjb and #agjd7 to carry out this section4 7f7 ,exemptions1 waivers1 and removals of sanctions and designations 7#a7 ,exemptions 7,a7 ,mandatory exemptions ,the following activities shall be exempt from sanctions under subsections 7b71 7c71 and 7d73 7i7 ,activities subject to the reporting requirements of title ,v of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjia et seq471 or to any authorized intelligence activities of the ,united ,states4 7ii7 ,any transaction necessary to comply with-- 7,i7 ,united ,states obligations under-- 7aa7 the ,agreement between the ,united ,nations and the ,united ,states of ,america regarding the ,headquarters of the ,united ,nations1 signed ,june #bf1 #aidg1 and entered into force on ,november #ba1 #aidg2 or 7bb7 the ,vienna ,convention on ,consular ,relations1 signed ,april #bd1 #aifc1 and entered into force on ,march #ai1 #aifg2 or 7,,ii7 other international commitments of the ,united ,states4 7#b7 ,waiver ,the ,president may waive the imposition of sanctions under this section for a period of not more than one year1 and may renew such waiver for additional periods of not more than one year1 if the ,president submits to the appropriate congressional committees a written determination that such waiver meets one or more of the following requirements3 7,a7 ,such waiver is important to the economic or national security interests of the ,united ,states4 7,b7 ,such waiver will further the enforcement of this ,act or is for an important law enforcement purpose4 7,c7 ,such waiver is for an important humanitarian purpose4 7#c7 ,removals of sanctions and designations ,the ,president may prescribe rules and regulations for the removal of sanctions under subsections 7b71 7c71 and 7d7 and the removal of designations under subsection 7a7 if the ,president determines that a foreign person1 agency or instrumentality of a foreign state1 or foreign state subject to such sanctions or designation1 as the case may be1 has-- 7,a7 verifiably ceased its participation in any of the conduct with respect to which such foreign person1 agency or instrumentality1 or foreign state was subject to such sanctions or designation1 as the case may be1 under this section2 and 7,b7 has given assurances that such foreign person1 agency or instrumentality1 or foreign state1 as the case may be1 will no longer participate in such conduct4 7g7 ,rule of construction ,nothing in this section may be construed to limit the authority of the ,president under the ,international ,emergency ,economic ,powers ,act 7#ej ,u4,s4,c4 #agja et seq47 or any other provision of law to impose sanctions to address critical cyber threat actors and malicious state-sponsored cyber activities4 7h7 ,definitions ,in this section3 7#a7 ,admitted2 alien ,the terms admitted and alien have the meanings given such terms in section #aja of the ,immigration and ,nationality ,act 7#h ,u4,s4,c4 #aaja74 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,foreign ,affairs1 the ,committee on ,financial ,services1 the ,committee on the ,judiciary1 the ,committee on ,oversight and ,government ,reform1 and the ,committee on ,homeland ,security of the ,house of ,representatives2 and 7,b7 the ,committee on ,foreign ,relations1 the ,committee on ,banking1 ,housing1 and ,urban ,affairs1 the ,committee on the ,judiciary1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate4 7#c7 ,agency or instrumentality of a foreign state ,the term agency or instrumentality of a foreign state has the meaning given such term in section #afjc7;b7 of title #bh1 ,united ,states ,code4 7#d7 ,critical infrastructure sector ,the term critical infrastructure sector means any of the critical infrastructure sectors identified in ,presidential ,policy ,directive ,no4 #ba1 entitled ,critical ,infrastructure ,security and ,resilience and dated ,february #ab1 #bjac4 7#e7 ,foreign person ,the term foreign person means a person that is not a ,united ,states person4 7#f7 ,foreign state ,the term foreign state has the meaning given such term in section #afjc7;a7 of title #bh1 ,united ,states ,code4 7#g7 ,knowingly ,the term knowingly1 with respect to conduct1 a circumstance1 or a result1 means that a person has actual knowledge1 or should have known1 of the conduct1 the circumstance1 or the result4 7#h7 ,misappropriation ,the term misappropriation means taking or obtaining by improper means1 without permission or consent1 or under false pretenses4 7#i7 ,state-sponsored cyber activities ,the term state-sponsored cyber activities means any malicious cyber-enabled activities that-- 7,a7 are carried out by a government of a foreign state or an agency or instrumentality of a foreign state2 or 7,b7 are carried out by a foreign person that is aided1 abetted1 or directed by a government of a foreign state or an agency or instrumentality of a foreign state4 7#aj7 ,united ,states person ,the term ,united ,states person means-- 7,a7 a ,united ,states citizen or an alien lawfully admitted for permanent residence to the ,united ,states2 or 7,b7 an entity organized under the laws of the ,united ,states or of any jurisdiction within the ,united ,states1 including a foreign branch of such an entity4