,i #aafth ,,congress #ast ,session ,h4 ,r4 #cbgj ,,in ,,the ,,house ,,of ,,representatives ,june #ac1 #bjai,mr4 ,graves of ,georgia 7for himself1 ,mr4 ,gottheimer1 ,mr4 ,austin ,scott of ,georgia1 ,mr4 ,cuellar1 ,mr4 ,carter of ,georgia1 ,mr4 ,ferguson1 ,mr4 ,riggleman1 ,mr4 ,loudermilk1 ,mr4 ,stewart1 ,mr4 ,palazzo1 ,mr4 ,hill of ,arkansas1 ,mr4 ,budd1 ,mr4 ,fortenberry1 ,mrs4 ,murphy1 ,mr4 ,reschenthaler1 and ,miss ,rice of ,new ,york7 introduced the following bill2 which was referred to the ,committee on the ,judiciary ,a ,,bill ,to amend title #ah1 ,united ,states ,code1 to provide a defense to prosecution for fraud and related activity in connection with computers for persons defending against unauthorized intrusions into their computers1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,active ,cyber ,defense ,certainty ,act4 #b4 ,congressional findings ,congress finds the following3 7#a7 ,cyber fraud and related cyber-enabled crimes pose a severe threat to the national security and economic vitality of the ,united ,states4 7#b7 ,as a result of the unique nature of cybercrime1 it is very difficult for law enforcement to respond to and prosecute cybercrime in a timely manner1 leading to the existing low level of deterrence and a rapidly growing threat4 ,in #bjag1 the ,department of ,justice prosecuted only #afe cases of computer fraud4 ,congress determines that this status quo is unacceptable and that if left unchecked1 the trend in cybercrime will only continue to deteriorate4 7#c7 ,cybercriminals have developed new tactics for monetizing the proceeds of their criminal acts1 making it likely that the criminal activity will be further incentivized in the absence of reforms to current law allowing for new cyber tools and deterrence methods for defenders4 7#d7 ,when a citizen or ,united ,states business is victimized as the result of such crime1 the first recourse should be to report the crime to law enforcement and seek to improve defensive measures4 7#e7 ,congress also acknowledges that many cyberattacks could be prevented through improved cyber defensive practices1 including enhanced training1 strong passwords1 and routine updating and patching to computer systems4 7#f7 ,congress determines that the use of active cyber defense techniques1 when properly applied1 can also assist in improving defenses and deterring cybercrimes4 7#g7 ,congress also acknowledges that many private entities are increasingly concerned with stemming the growth of dark web based cyber-enabled crimes4 ,the ,department of ,justice should attempt to clarify the proper protocol for entities who are engaged in active cyber defense in the dark web so that these defenders can return private property such as intellectual property and financial records gathered inadvertently4 7#h7 ,congress also recognizes that while ,federal agencies will need to prioritize cyber incidents of national significance1 there is the potential to assist the private sector by being more responsive to reports of crime through different reporting mechanisms4 ,many reported cybercrimes are not responded to in a timely manner creating significant uncertainty for many businesses and individuals4 7#i7 ,computer defenders should also exercise extreme caution to avoid violating the law of any other nation where an attacker's computer may reside4 7#aj7 ,congress holds that active cyber defense techniques should only be used by qualified defenders with a high degree of confidence in attribution1 and that extreme caution should be taken to avoid impacting intermediary computers or resulting in an escalatory cycle of cyber activity4 7#aa7 ,it is the purpose of this ,act to provide legal certainty by clarifying the type of tools and techniques that defenders can use that exceed the boundaries of their own computer network4 #c4 ,exception for the use of attributional technology ,section #ajcj of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 7k7 ,exception for the use of attributional technology 7#a7 ,this section shall not apply with respect to the use of attributional technology in regard to a defender who uses a program1 code1 or command for attributional purposes that beacons or returns locational or attributional data in response to a cyber intrusion in order to identify the source of an intrusion2 if-- 7,a7 the program1 code1 or command originated on the computer of the defender but is copied or removed by an unauthorized user2 and 7,b7 the program1 code1 or command does not result in the destruction of data or result in an impairment of the essential operating functionality of the attacker's computer system1 or intentionally create a backdoor enabling intrusive access into the attacker's computer system4 7#b7 ,definition ,the term attributional data means any digital information such as log files1 text strings1 time stamps1 malware samples1 identifiers such as user names and ,internet ,protocol addresses and metadata or other digital artifacts gathered through forensic analysis4 4 #d4 ,exclusion from prosecution for certain computer crimes for those taking active cyber defense measures ,section #ajcj of title #ah1 ,united ,states ,code1 is amended by adding at the end the following3 7l7 ,active cyber defense measures not a violation 7#a7 ,generally ,it is a defense to a criminal prosecution under this section that the conduct constituting the offense was an active cyber defense measure4 7#b7 ,inapplicability to civil action ,the defense against prosecution created by this section does not prevent a ,united ,states person or entity who is targeted by an active defense measure from seeking a civil remedy1 including compensatory damages or injunctive relief pursuant to subsection 7g74 7#c7 ,definitions ,in this subsection-- 7,a7 the term defender means a person or an entity that is a victim of a persistent unauthorized intrusion of the individual entity's computer2 7,b7 the term active cyber defense measure-- 7i7 means any measure-- 7,i7 undertaken by1 or at the direction of1 a defender2 and 7,,ii7 consisting of accessing without authorization the computer of the attacker to the defender's own network to gather information in order to-- 7aa7 establish attribution of criminal activity to share with law enforcement and other ,united ,states ,government agencies responsible for cybersecurity2 7bb7 disrupt continued unauthorized activity against the defender's own network2 or 7cc7 monitor the behavior of an attacker to assist in developing future intrusion prevention or cyber defense techniques2 but 7ii7 does not include conduct that-- 7,i7 intentionally destroys or renders inoperable information that does not belong to the victim that is stored on another person or entity's computer2 7,,ii7 recklessly causes physical injury or financial loss as described under subsection 7c77#d72 7,,iii7 creates a threat to the public health or safety2 7,,iv7 intentionally exceeds the level of activity required to perform reconnaissance on an intermediary computer to allow for attribution of the origin of the persistent cyber intrusion2 7,v7 intentionally results in intrusive or remote access into an intermediary's computer2 7,,vi7 intentionally results in the persistent disruption to a person or entities internet connectivity resulting in damages defined under subsection 7c77#d72 or 7,,vii7 impacts any computer described under subsection 7a77#a7 regarding access to national security information1 subsection 7a77#c7 regarding government computers1 or to subsection 7c77#d77;,a77i77,v7 regarding a computer system used by or for a ,government entity for the furtherance of the administration of justice1 national defense1 or national security2 7,c7 the term attacker means a person or an entity that is the source of the persistent unauthorized intrusion into the victim's computer2 and 7,d7 the term intermediary computer means a person or entity's computer that is not under the ownership or primary control of the attacker but has been used to launch or obscure the origin of the persistent cyber-attack4 4 #e4 ,notification requirement for the use of active cyber defense measures ,section #ajcj of title #ah1 ,united ,states ,code1 is amended by adding the following3 7m7 ,notification requirement for the use of active cyber defense measures 7#a7 ,generally ,a defender who uses an active cyber defense measure under the preceding section must notify the ,,fbi ,national ,cyber ,investigative ,joint ,task ,force and receive a response from the ,,fbi acknowledging receipt of the notification prior to using the measure4 7#b7 ,required information ,notification must include the type of cyber breach that the person or entity was a victim of1 the intended target of the active cyber defense measure1 the steps the defender plans to take to preserve evidence of the attacker's criminal cyber intrusion1 as well as the steps they plan to prevent damage to intermediary computers not under the ownership of the attacker and other information requested by the ,,fbi to assist with oversight4 4 #f4 ,voluntary preemptive review of active cyber defense measures 7a7 ,pilot program ,the ,federal ,bureau of ,investigation 7hereinafter in this section referred to as the ,,fbi71 in coordination with other ,federal agencies1 shall create a pilot program to last for #b years after the date of enactment of this ,act1 to allow for a voluntary preemptive review of active defense measures4 7b7 ,advance review ,a defender who intends to prepare an active defense measure under section #d may submit their notification to the ,,fbi ,national ,cyber ,investigative ,joint ,task ,force in advance of its use so that the ,,fbi and other agencies can review the notification and provide its assessment on how the proposed active defense measure may be amended to better conform to ,federal law1 the terms of section #d1 and improve the technical operation of the measure4 7c7 ,prioritization of requests ,the ,,fbi may decide how to prioritize the issuance of such guidance to defenders based on the availability of resources4 #g4 ,annual report on the ,federal ,government's progress in deterring cyber fraud and cyber-enabled crimes ,the ,department of ,justice1 after consultation with the ,department of ,homeland ,security and other relevant ,federal agencies1 shall deliver an annual report to ,congress not later than ,march #ca of each year1 detailing the results of law enforcement activities pertaining to cybercriminal deterrence for the previous calendar year4 ,the report shall include-- 7#a7 the number of computer fraud cases reported by ,united ,states citizens and ,united ,states businesses to ,,fbi ,field ,offices1 the ,secret ,service ,electronic ,crimes ,task ,force1 the ,internet ,crimes ,complaint ,center 7,,ic#c7 website1 and other ,federal law enforcement agencies2 7#b7 the number of investigations opened as a result of public reporting of computer fraud crimes1 and the number of investigations open independently of any specific crimes being reported2 7#c7 the number of cyber fraud cases prosecuted under section #ajcj of title #ah1 ,united ,states ,code1 and other related statutes involving cybercrime1 including the resolution of the cases2 7#d7 the number of computer fraud crimes determined to have originated from ,united ,states suspects and the number determined to have originated from foreign suspects1 and details of the country of origin of the suspected foreign suspects2 7#e7 the number of dark web cybercriminal marketplaces and cybercriminal networks disabled by law enforcement activities2 7#f7 an estimate of the total financial damages suffered by ,united ,states citizens and businesses resulting from ransomware and other fraudulent cyberattacks2 7#g7 the number of law enforcement personnel assigned to investigate and prosecute cybercrimes2 and 7#h7 the number of active cyber defense notifications filed as required by this ,act and a comprehensive evaluation of the notification process and voluntary preemptive review pilot program4 #h4 ,requirement for the ,department of ,justice to update the manual on the prosecution of cybercrimes 7a7 ,the ,department of ,justice shall update the ,prosecuting ,computer ,crimes ,manual to reflect the changes made by this legislation4 7b7 ,the ,department of ,justice is encouraged to seek additional opportunities to clarify the manual and other guidance to the public to reflect evolving defensive techniques and cyber technology that can be used in manner that does not violate section #ajcj of title #ah1 ,united ,states ,code1 or other ,federal law and international treaties4 #i4 ,sunset ,the exclusion from prosecution created by this ,act shall expire #b years after the date of enactment of this ,act4