,,ii  #aafth ,,congress  #ast ,session  
,s4 #cjde  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,december #ab1 
#bjai,mr4 ,johnson 7for himself and ,ms4
 ,hassan7 introduced the following bill2
 which was read twice and referred to   
the ,committee on ,homeland ,security   
and ,governmental ,affairs  ,a ,,bill   
,to amend the ,homeland ,security ,act  
of #bjjb to protect ,united ,states     
critical infrastructure by ensuring that
 the ,cybersecurity and ,infrastructure 
,security ,agency has the legal tools it
 needs to notify private and public     
sector entities put at risk by          
cybersecurity vulnerabilities in the    
networks and systems that control       
critical assets of the ,united ,states4 
#a4 ,short title ,this ,act may be cited
 as the ,cybersecurity ,vulnerability   
,identification and ,notification ,act  
of #bjai4  #b4 ,subpoena authority  7a7 
,in general ,section #bbji of the       
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #fei7 is amended-- 7#a7 in    

subsection 7a7--  7,a7 by redesignating 
paragraph 7#f7 as paragraph 7#g72 and   
7,b7 by inserting after paragraph 7#e7  
the following3  7#f7 the term security  
vulnerability has the meaning given that
 term in section #ajb7ag7 of the        
,cybersecurity ,information ,sharing    
,act of #bjae 7#f ,u4,s4,c4 #aeja7ag772 
2  7#b7 in subsection 7c7-- 7,a7 in     
paragraph 7#aj71 by striking and at the 
end2  7,b7 in paragraph 7#aa71 by       
striking the period at the end and      
inserting 2 and2 and  7,c7 by adding at 
the end the following3  7#ab7 detecting1
 identifying1 and receiving information 
about security vulnerabilities relating 
to critical infrastructure in the       
information systems and devices of      
,federal and non-,federal entities for a
 cybersecurity purpose1 as defined in   
section #ajb of the ,cybersecurity      
,information ,sharing ,act of #bjae 7#f 
,u4,s4,c4 #aeja74  2 and  7#c7 by adding
 at the end the following3  7n7         
,subpoena authority  7#a7 ,definition   

,in this subsection1 the term enterprise
 device or system--  7,a7 means a device
 or system commonly used to perform     
industrial1 commercial1 scientific1 or  
governmental functions or processes that
 relate to critical infrastructure1     
including operational and industrial    
control systems1 distributed control    
systems1 and programmable logic         
controllers2 and  7,b7 does not include 
personal devices and systems1 such as   
consumer mobile devices1 home computers1
 residential wireless routers1 or       
residential internet-enabled consumer   
devices4  7#b7 ,authority  7,a7 ,in     
general ,if the ,director identifies a  
system connected to the internet with a 
specific security vulnerability and has 
reason to believe that the security     
vulnerability relates to critical       
infrastructure and affects an enterprise
 device or system owned or operated by a
 ,federal or non-,federal entity1 and   
the ,director is unable to identify the 
entity at risk1 the ,director may issue 

a subpoena for the production of        
information necessary to identify and   
notify the entity at risk1 in order to  
carry out a function authorized under   
subsection 7c77#ab74  7,b7 ,limit on    
information ,a subpoena issued under the
 authority under subparagraph 7,a7 may  
only seek information in the categories 
set forth in subparagraphs 7,a71 7,b71  
7,d71 and 7,e7 of section #bgjc7;c77#b7 
of title #ah1 ,united ,states ,code4    
7,c7 ,liability protections for         
disclosing providers ,the provisions of 
section #bgjc7;e7 of title #ah1 ,united 
,states ,code1 shall apply to any       
subpoena issued under the authority     
under subparagraph 7,a74  7#c7          
,coordination  7,a7 ,in general ,if the 
,director decides to exercise the       
subpoena authority under this           
subsection1 and in the interest of      
avoiding interference with ongoing law  
enforcement investigations1 the         
,director shall coordinate the issuance 
of any such subpoena with the           

,department of ,justice1 including the  
,federal ,bureau of ,investigation1     
pursuant to inter-agency procedures     
which the ,director1 in coordination    
with the ,attorney ,general1 shall      
develop not later than #fj days after   
the date of enactment of this           
subsection4  7,b7 ,contents ,the        
inter-agency procedures developed under 
this paragraph shall provide that a     
subpoena issued by the ,director under  
this subsection shall be--  7i7 issued  
in order to carry out a function        
described in subsection 7c77#ab72 and   
7ii7 subject to the limitations under   
this subsection4  7#d7 ,noncompliance   
,if any person1 partnership1            
corporation1 association1 or entity     
fails to comply with any duly served    
subpoena issued under this subsection1  
the ,director may request that the      
,attorney ,general seek enforcement of  
the subpoena in any judicial district in
 which such person1 partnership1        
corporation1 association1 or entity     

resides1 is found1 or transacts         
business4  7#e7 ,notice ,not later than 
#g days after the date on which the     
,director receives information obtained 
through a subpoena issued under this    
subsection1 the ,director shall notify  
the entity at risk identified by        
information obtained under the subpoena 
regarding the subpoena and the          
identified vulnerability4  7#f7         
,authentication ,any subpoena issued by 
the ,director under this subsection     
shall be authenticated by the electronic
 signature of an authorized             
representative of the ,agency or other  
comparable symbol or process identifying
 the ,agency as the source of the       
subpoena4  7#g7 ,procedures ,not later  
than #ij days after the date of         
enactment of this subsection1 the       
,director shall establish internal      
procedures and associated training1     
applicable to employees and operations  
of the ,agency1 regarding subpoenas     
issued under this subsection1 which     

shall address--  7,a7 the protection of 
and restriction on dissemination of     
nonpublic information obtained through a
 subpoena issued under this subsection1 
including a requirement that the ,agency
 shall not disseminate nonpublic        
information obtained through a subpoena 
issued under this subsection that       
identifies the party that is subject to 
the subpoena or the entity at risk      
identified by information obtained1     
unless--  7i7 the party or entity       
consents2 or  7ii7 the ,agency          
identifies or is notified of a          
cybersecurity incident involving the    
party or entity1 which relates to the   
vulnerability which led to the issuance 
of the subpoena2  7,b7 the restriction  
on the use of information obtained      
through the subpoena for a cybersecurity
 purpose1 as defined in section #ajb of 
the ,cybersecurity ,information ,sharing
 ,act of #bjae 7#f ,u4,s4,c4 #aeja72    
7,c7 the retention and destruction of   
nonpublic information obtained through a

 subpoena issued under this subsection1 
including--  7i7 immediate destruction  
of information obtained through the     
subpoena that the ,director determines  
is unrelated to critical infrastructure2
 and  7ii7 destruction of any personally
 identifiable information not later than
 #f months after the date on which the  
,director receives information obtained 
through the subpoena1 unless otherwise  
agreed to by the individual identified  
by the subpoena respondent2  7,d7 the   
processes for providing notice to each  
party that is subject to the subpoena   
and each entity at risk identified by   
information obtained pursuant to a      
subpoena issued under this subsection2  
and  7,e7 the processes and criteria for
 conducting critical infrastructure     
security risk assessments to determine  
whether a subpoena is necessary prior to
 being issued under this subsection4    
7#h7 ,review of procedures ,not later   
than #a year after the date of enactment
 of this subsection1 the ,privacy       

,officer of the ,agency shall--  7,a7   
review the procedures developed by the  
,director under paragraph 7#g7 to ensure
 that-- 7i7 the procedures are          
consistent with fair information        
practices2 and  7ii7 the operations of  
the ,agency comply with the procedures2 
and  7,b7 notify the ,committee on      
,homeland ,security and ,governmental   
,affairs of the ,senate and the         
,committee on ,homeland ,security of the
 ,house of ,representatives of the      
results of the review4  7#i7            
,publication of information ,not later  
than #abj days after establishing the   
internal procedures under paragraph     
7#g71 the ,director shall make publicly 
available information regarding the     
subpoena process under this subsection1 
including regarding--  7,a7 the purpose 
for subpoenas issued under this         
subsection2  7,b7 the subpoena process2 
7,c7 the criteria for the critical      
infrastructure security risk assessment 
conducted prior to issuing a subpoena2  

7,d7 policies and procedures on         
retention and sharing of data obtained  
by subpoena2  7,e7 guidelines on how    
entities contacted by the ,director may 
respond to notice of a subpoena2 and    
7,f7 the procedures and policies of the 
,agency developed under paragraph 7#g74 
7#aj7 ,annual reports ,the ,director    
shall annually submit to the ,committee 
on ,homeland ,security and ,governmental
 ,affairs of the ,senate and the        
,committee on ,homeland ,security of the
 ,house of ,representatives a report    
7which may include a classified annex   
but with the presumption of             
declassification7 on the use of         
subpoenas under this subsection by the  
,director1 which shall include--  7,a7 a
 discussion of-- 7i7 the effectiveness  
of the use of subpoenas to mitigate     
critical infrastructure security        
vulnerabilities2  7ii7 the critical     
infrastructure security risk assessment 
process conducted for subpoenas issued  
under this subsection2  7iii7 the number

 of subpoenas issued under this         
subsection by the ,director during the  
preceding year2  7iv7 to the extent     
practicable1 the number of vulnerable   
enterprise devices or systems mitigated 
under this subsection by the ,agency    
during the preceding year2 and  7v7 the 
number of entities notified by the      
,director under this subsection1 and    
their response1 during the previous     
year2 and  7,b7 for each subpoena issued
 under this subsection-- 7i7 the source 
of the security vulnerability detected1 
identified1 or received by the          
,director2  7ii7 the steps taken to     
identify the entity at risk prior to    
issuing the subpoena2 and  7iii7 a      
description of the outcome of the       
subpoena1 including discussion on the   
resolution or mitigation of the critical
 infrastructure security vulnerability4 
7#aa7 ,publication of the annual reports
 ,the ,director shall make a version of 
the annual report required by paragraph 
7#aj7 publicly available1 which shall1  

at a minimum1 include the findings      
described in clause 7iii71 7iv7 and 7v7 
of subparagraph 7,a74  4