,i #aafth ,,congress #b;d ,session ,h4 ,r4 #efhj ,,in ,,the ,,house ,,of ,,representatives ,january #bg1 #bjbj,mr4 ,langevin 7for himself1 ,mr4 ,katko1 ,mr4 ,richmond1 ,mr4 ,thompson of ,mississippi1 and ,ms4 ,jackson ,lee7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to protect ,united ,states critical infrastructure by ensuring that the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security has necessary legal tools to notify entities at risk of cybersecurity vulnerabilities in the enterprise devices or systems that control critical assets of the ,united ,states1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cybersecurity ,vulnerability ,identification and ,notification ,act of #bjbj4 #b4 ,subpoena authority 7a7 ,in general ,section #bbji of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei7 is amended-- 7#a7 in subsection 7a7-- 7,a7 in this subsection1 by inserting 1 cybersecurity purpose1 after cyber threat indicator2 7,b7 by redesignating paragraphs 7#c7 through 7#f7 as paragraphs 7#d7 through 7#g71 respectively2 7,c7 by inserting after this subsection the following new paragraph3 7#c7 the term enterprise device or system-- 7,a7 means a device or information system commonly used to perform industrial1 commercial1 scientific1 or governmental functions or processes that relate to critical infrastructure1 including operational and industrial control systems1 distributed control systems1 and programmable logic controllers2 and 7,b7 does not include personal devices and systems1 such as consumer mobile devices1 home computers1 residential wireless routers1 or residential internet-enabled consumer devices2 2 and 7,d7 in paragraph 7#f71 as so redesignated1 by striking term information system has the meaning given that term in section #cejb7h7 of title #dd2 and and inserting terms information system and security vulnerability have the meanings given those terms in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja722 7#b7 in subsection 7c7-- 7,a7 in paragraph 7#h77;,c71 by striking sharing and inserting share2 7,b7 in paragraph 7#aj71 by striking and after the semicolon at the end2 7,c7 in paragraph 7#aa71 by striking the period at the end and inserting 2 and2 and 7,d7 by adding at the end the following new paragraph3 7#ab7 detecting1 identifying1 and receiving information about security vulnerabilities relating to information systems for a cybersecurity purpose4 2 and 7#c7 by adding at the end the following new subsection3 7n7 ,subpoena authority 7#a7 ,in general ,if the ,director identifies an information system connected to the internet with a specific security vulnerability and has reason to believe that the security vulnerability relates to critical infrastructure and affects an enterprise device or system of an entity1 and the ,director made reasonable efforts to identify the entity at risk but was unable to do so1 the ,director may issue a subpoena for the production of information necessary to identify and notify the entity at risk1 in order to carry out a cybersecurity purpose4 7#b7 ,limit on information ,a subpoena issued under this subsection may only seek information in the categories set forth in subparagraphs 7,a71 7,b71 7,d71 and 7,e7 of section #bgjc7;c77#b7 of title #ah1 ,united ,states ,code4 7#c7 ,liability protections for disclosing providers ,the provisions of section #bgjc7;e7 of title #ah1 ,united ,states ,code1 shall apply to any subpoena issued under this subsection4 7#d7 ,coordination 7,a7 ,in general ,not later than #fj days after the date of the enactment of this subsection1 the ,director1 in coordination with the ,attorney ,general1 shall develop inter-agency procedures regarding the issuance of subpoenas under this subsection in order to avoid interference with ongoing law enforcement investigations4 ,to the extent practicable1 the ,director shall coordinate such issuances with the ,department of ,justice1 including the ,federal ,bureau of ,investigation1 pursuant to such procedures4 7,b7 ,contents ,the inter-agency procedures developed under this paragraph shall provide that a subpoena issued by the ,director under this subsection shall be-- 7i7 issued solely in order to carry out a cybersecurity purpose2 and 7ii7 subject to the limitations under this subsection4 7#e7 ,noncompliance ,if any person1 partnership1 corporation1 association1 or entity fails to comply with any duly served subpoena issued under this subsection1 the ,director may request that the ,attorney ,general seek enforcement of the subpoena in any judicial district in which such person1 partnership1 corporation1 association1 or entity resides1 is found1 or transacts business4 7#f7 ,notice ,not later than seven days after the date on which the ,director receives information obtained through a subpoena issued under this subsection1 the ,director shall notify the entity at risk identified by information obtained under the subpoena regarding the subpoena and the identified security vulnerability4 7#g7 ,authentication ,any subpoena issued by the ,director under this subsection shall be authenticated by the electronic signature of an authorized representative of the ,agency or other comparable symbol or process identifying the ,agency as the source of the subpoena4 7#h7 ,procedures 7,a7 ,in general ,not later than #ij days after the date of enactment of this subsection1 the ,director shall establish internal procedures and associated training1 applicable to employees and operations of the ,agency1 regarding subpoenas issued under this subsection1 which shall address the following3 7i7 ,the protection of and restriction on dissemination of nonpublic information obtained through such a subpoena1 including a requirement that the ,agency may not disseminate nonpublic information obtained through such a subpoena that identifies the party that is subject to such a subpoena or the entity at risk identified by information obtained as a result of such a subpoena1 unless-- 7,i7 the party or entity consents2 or 7,,ii7 the ,agency identifies or is notified of a cybersecurity incident involving the party or entity1 which relates to the security vulnerability which led to the issuance of such a subpoena4 7ii7 ,the restriction on the use of information obtained through the subpoena for a cybersecurity purpose4 7iii7 ,the retention and destruction of nonpublic information obtained through such a subpoena1 including the following3 7,i7 ,immediate destruction of information obtained through such a subpoena that the ,director determines is unrelated to critical infrastructure4 7,,ii7 ,destruction of any personally identifiable information not later than six months after the date on which the ,director receives information obtained through such a subpoena1 unless otherwise agreed to by the individual so identified4 7iv7 ,the process for recordkeeping regarding efforts referred to in paragraph 7#a7 undertaken prior to the issuance of such a subpoena4 7v7 ,the process for tracking engagement with each party that is subject to such a subpoena and the entity at risk identified by information obtained pursuant to such a subpoena4 7vi7 ,the process for providing notice to each party that is subject to such a subpoena and each entity at risk identified by information obtained pursuant to such a subpoena4 7vii7 ,the process and criteria for conducting critical infrastructure security risk assessments to determine whether a subpoena is necessary prior to being so issued4 7,b7 ,congressional notification ,the ,director shall brief the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate upon establishment of internal procedures and associated training required under this subsection4 7#i7 ,review of procedures ,not later than one year after the date of enactment of this subsection1 the ,privacy ,officer of the ,agency1 in consultation with the ,privacy ,officer of the ,department1 shall-- 7,a7 review the internal procedures and associated training established by the ,director under paragraph 7#h7 to ensure that-- 7i7 the procedures and training are consistent with fair information practices2 and 7ii7 the operations of the ,agency comply with the procedures and training2 and 7,b7 notify the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate of the results of such review4 7#aj7 ,resource assessment ,not later than #abj days after the date of the enactment of this subsection1 the ,director shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate an assessment regarding whether additional resources are required to-- 7,a7 7i7 ensure timely notifications to entities at risk pursuant to paragraph 7#f72 and 7ii7 provide such entities at risk with timely support to mitigate security vulnerabilities2 and 7,b7 provide associated training applicable to employees and operations of the ,agency to comply with internal procedures established pursuant to paragraph 7#h74 7#aa7 ,publication of information ,not later than #abj days after establishing the internal procedures and policies under paragraph 7#h71 the ,director shall make publicly available1 including on a ,department website1 information regarding the subpoena process under this subsection1 including regarding the following3 7,a7 ,the purpose for subpoenas issued under this subsection4 7,b7 ,the subpoena process4 7,c7 ,the criteria for the critical infrastructure security risk assessment conducted prior to issuing a subpoena4 7,d7 ,policies and procedures on retention and sharing of data obtained by a subpoena4 7,e7 ,the process for providing notice to each entity at risk identified by information obtained pursuant to a subpoena issued under this subsection1 and contact information that such an entity may use to confirm the authenticity of such notice4 7,f7 ,guidelines on how entities at risk contacted by the ,director may respond to notice of a subpoena4 7,g7 ,the internal procedures of the ,agency established pursuant to paragraph 7#h74 7#ab7 ,annual reports ,not later than six months after the establishment of the internal procedures and associated training pursuant to paragraph 7#h7 and annually thereafter1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report 7which may include a classified annex but with the presumption of declassification7 on the use of subpoenas under this subsection by the ,director1 which shall include the following3 7,a7 ,a discussion of the following3 7i7 ,the effectiveness of the use of subpoenas to mitigate security vulnerabilities4 7ii7 ,the critical infrastructure security risk assessment process conducted for subpoenas issued under this subsection4 7iii7 ,the number of subpoenas issued under this subsection by the ,director during the preceding year4 7iv7 ,to the extent practicable1 the number of vulnerable enterprise devices or systems mitigated under this subsection by the ,agency during the preceding year4 7v7 ,the number of entities notified by the ,director under this subsection1 and their responses1 during the preceding year4 7,b7 ,for each subpoena issued under this subsection1 the following3 7i7 ,the source of the security vulnerability at issue detected1 identified1 or received by the ,director4 7ii7 ,a description of the efforts undertaken to identify the entity at risk prior to issuing each such subpoena4 7iii7 ,a description of the outcome of each such subpoena1 including discussion regarding the resolution or mitigation of the security vulnerability at issue4 7iv7 ,a description of any additional support provided by the ,director to the entity at risk4 7#ac7 ,publication of the annual reports ,the ,director shall make publicly available a version of each annual report required under paragraph 7#ab71 which shall at a minimum include the findings described in clause 7iii71 7iv71 and 7v7 of this subsection of such paragraph4 7#ad7 ,,dhs ,inspector ,general report ,not later than one year after the date of the enactment of this subsection1 the ,inspector ,general of the ,department shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report evaluating the ,agency's compliance with the following3 7,a7 ,the inter-agency procedures established under paragraph 7#d74 7,b7 ,the internal procedures and associated training established pursuant to paragraph 7#h74 4