,,ii ,calendar ,no4 #ejj #aafth ,,congress #b;d ,session ,s4 #cjde ,report ,no4 #aaf-bdb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #ab1 #bjai,mr4 ,johnson 7for himself1 ,ms4 ,hassan1 ,mr4 ,wyden1 and ,mr4 ,king7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,july #bi1 #bjbj,reported by ,mr4 ,johnson1 with an amendment,strike out all after the enacting clause and insert the part printed in italic ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to protect ,united ,states critical infrastructure by ensuring that the ,cybersecurity and ,infrastructure ,security ,agency has the legal tools it needs to notify private and public sector entities put at risk by cybersecurity vulnerabilities in the networks and systems that control critical assets of the ,united ,states4 #a4 ,short title ,this ,act may be cited as the ,cybersecurity ,vulnerability ,identification and ,notification ,act of #bjai4 #b4 ,subpoena authority 7a7 ,in general ,section #bbji of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei7 is amended-- 7#a7 in subsection 7a7-- 7,a7 by redesignating paragraph 7#f7 as paragraph 7#g72 and 7,b7 by inserting after paragraph 7#e7 the following3 7#f7 the term security vulnerability has the meaning given that term in section #ajb7ag7 of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja7ag772 2 7#b7 in subsection 7c7-- 7,a7 in paragraph 7#aj71 by striking and at the end2 7,b7 in paragraph 7#aa71 by striking the period at the end and inserting 2 and2 and 7,c7 by adding at the end the following3 7#ab7 detecting1 identifying1 and receiving information about security vulnerabilities relating to critical infrastructure in the information systems and devices of ,federal and non-,federal entities for a cybersecurity purpose1 as defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 2 and 7#c7 by adding at the end the following3 7n7 ,subpoena authority 7#a7 ,definition ,in this subsection1 the term enterprise device or system-- 7,a7 means a device or system commonly used to perform industrial1 commercial1 scientific1 or governmental functions or processes that relate to critical infrastructure1 including operational and industrial control systems1 distributed control systems1 and programmable logic controllers2 and 7,b7 does not include personal devices and systems1 such as consumer mobile devices1 home computers1 residential wireless routers1 or residential internet-enabled consumer devices4 7#b7 ,authority 7,a7 ,in general ,if the ,director identifies a system connected to the internet with a specific security vulnerability and has reason to believe that the security vulnerability relates to critical infrastructure and affects an enterprise device or system owned or operated by a ,federal or non-,federal entity1 and the ,director is unable to identify the entity at risk1 the ,director may issue a subpoena for the production of information necessary to identify and notify the entity at risk1 in order to carry out a function authorized under subsection 7c77#ab74 7,b7 ,limit on information ,a subpoena issued under the authority under subparagraph 7,a7 may only seek information in the categories set forth in subparagraphs 7,a71 7,b71 7,d71 and 7,e7 of section #bgjc7;c77#b7 of title #ah1 ,united ,states ,code4 7,c7 ,liability protections for disclosing providers ,the provisions of section #bgjc7;e7 of title #ah1 ,united ,states ,code1 shall apply to any subpoena issued under the authority under subparagraph 7,a74 7#c7 ,coordination 7,a7 ,in general ,if the ,director decides to exercise the subpoena authority under this subsection1 and in the interest of avoiding interference with ongoing law enforcement investigations1 the ,director shall coordinate the issuance of any such subpoena with the ,department of ,justice1 including the ,federal ,bureau of ,investigation1 pursuant to inter-agency procedures which the ,director1 in coordination with the ,attorney ,general1 shall develop not later than #fj days after the date of enactment of this subsection4 7,b7 ,contents ,the inter-agency procedures developed under this paragraph shall provide that a subpoena issued by the ,director under this subsection shall be-- 7i7 issued in order to carry out a function described in subsection 7c77#ab72 and 7ii7 subject to the limitations under this subsection4 7#d7 ,noncompliance ,if any person1 partnership1 corporation1 association1 or entity fails to comply with any duly served subpoena issued under this subsection1 the ,director may request that the ,attorney ,general seek enforcement of the subpoena in any judicial district in which such person1 partnership1 corporation1 association1 or entity resides1 is found1 or transacts business4 7#e7 ,notice ,not later than #g days after the date on which the ,director receives information obtained through a subpoena issued under this subsection1 the ,director shall notify the entity at risk identified by information obtained under the subpoena regarding the subpoena and the identified vulnerability4 7#f7 ,authentication ,any subpoena issued by the ,director under this subsection shall be authenticated by the electronic signature of an authorized representative of the ,agency or other comparable symbol or process identifying the ,agency as the source of the subpoena4 7#g7 ,procedures ,not later than #ij days after the date of enactment of this subsection1 the ,director shall establish internal procedures and associated training1 applicable to employees and operations of the ,agency1 regarding subpoenas issued under this subsection1 which shall address-- 7,a7 the protection of and restriction on dissemination of nonpublic information obtained through a subpoena issued under this subsection1 including a requirement that the ,agency shall not disseminate nonpublic information obtained through a subpoena issued under this subsection that identifies the party that is subject to the subpoena or the entity at risk identified by information obtained1 unless-- 7i7 the party or entity consents2 or 7ii7 the ,agency identifies or is notified of a cybersecurity incident involving the party or entity1 which relates to the vulnerability which led to the issuance of the subpoena2 7,b7 the restriction on the use of information obtained through the subpoena for a cybersecurity purpose1 as defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja72 7,c7 the retention and destruction of nonpublic information obtained through a subpoena issued under this subsection1 including-- 7i7 immediate destruction of information obtained through the subpoena that the ,director determines is unrelated to critical infrastructure2 and 7ii7 destruction of any personally identifiable information not later than #f months after the date on which the ,director receives information obtained through the subpoena1 unless otherwise agreed to by the individual identified by the subpoena respondent2 7,d7 the processes for providing notice to each party that is subject to the subpoena and each entity at risk identified by information obtained pursuant to a subpoena issued under this subsection2 and 7,e7 the processes and criteria for conducting critical infrastructure security risk assessments to determine whether a subpoena is necessary prior to being issued under this subsection4 7#h7 ,review of procedures ,not later than #a year after the date of enactment of this subsection1 the ,privacy ,officer of the ,agency shall-- 7,a7 review the procedures developed by the ,director under paragraph 7#g7 to ensure that-- 7i7 the procedures are consistent with fair information practices2 and 7ii7 the operations of the ,agency comply with the procedures2 and 7,b7 notify the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives of the results of the review4 7#i7 ,publication of information ,not later than #abj days after establishing the internal procedures under paragraph 7#g71 the ,director shall make publicly available information regarding the subpoena process under this subsection1 including regarding-- 7,a7 the purpose for subpoenas issued under this subsection2 7,b7 the subpoena process2 7,c7 the criteria for the critical infrastructure security risk assessment conducted prior to issuing a subpoena2 7,d7 policies and procedures on retention and sharing of data obtained by subpoena2 7,e7 guidelines on how entities contacted by the ,director may respond to notice of a subpoena2 and 7,f7 the procedures and policies of the ,agency developed under paragraph 7#g74 7#aj7 ,annual reports ,the ,director shall annually submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report 7which may include a classified annex but with the presumption of declassification7 on the use of subpoenas under this subsection by the ,director1 which shall include-- 7,a7 a discussion of-- 7i7 the effectiveness of the use of subpoenas to mitigate critical infrastructure security vulnerabilities2 7ii7 the critical infrastructure security risk assessment process conducted for subpoenas issued under this subsection2 7iii7 the number of subpoenas issued under this subsection by the ,director during the preceding year2 7iv7 to the extent practicable1 the number of vulnerable enterprise devices or systems mitigated under this subsection by the ,agency during the preceding year2 and 7v7 the number of entities notified by the ,director under this subsection1 and their response1 during the previous year2 and 7,b7 for each subpoena issued under this subsection-- 7i7 the source of the security vulnerability detected1 identified1 or received by the ,director2 7ii7 the steps taken to identify the entity at risk prior to issuing the subpoena2 and 7iii7 a description of the outcome of the subpoena1 including discussion on the resolution or mitigation of the critical infrastructure security vulnerability4 7#aa7 ,publication of the annual reports ,the ,director shall make a version of the annual report required by paragraph 7#aj7 publicly available1 which shall1 at a minimum1 include the findings described in clause 7iii71 7iv7 and 7v7 of subparagraph 7,a74 4 #a4 ,short title ,this ,act may be cited as the ,cybersecurity ,vulnerability ,identification and ,notification ,act of #bjbj4 #b4 ,subpoena authority 7a7 ,in general ,section #bbji of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei7 is amended-- 7#a7 in subsection 7a7-- 7,a7 in paragraph 7#e71 by striking and at the end2 7,b7 by redesignating paragraph 7#f7 as paragraph 7#g72 and 7,c7 by inserting after paragraph 7#e7 the following3 7#f7 the term security vulnerability has the meaning given that term in section #ajb7ag7 of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja7ag772 and 2 7#b7 in subsection 7c7-- 7,a7 in paragraph 7#aj71 by striking and at the end2 7,b7 in paragraph 7#aa71 by striking the period at the end and inserting 2 and2 and 7,c7 by adding at the end the following3 7#ab7 detecting1 identifying1 and receiving information about security vulnerabilities relating to critical infrastructure in the information systems and devices of ,federal and non-,federal entities for a cybersecurity purpose1 as defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 2 and 7#c7 by adding at the end the following3 7o7 ,subpoena authority 7#a7 ,definition ,in this subsection1 the term covered device or system-- 7,a7 means a device or system commonly used to perform industrial1 commercial1 scientific1 or governmental functions or processes that relate to critical infrastructure1 including operational and industrial control systems1 distributed control systems1 and programmable logic controllers2 and 7,b7 does not include personal devices and systems1 such as consumer mobile devices1 home computers1 residential wireless routers1 or residential internet enabled consumer devices4 7#b7 ,authority 7,a7 ,in general ,if the ,director identifies a system connected to the internet with a specific security vulnerability and has reason to believe that the security vulnerability relates to critical infrastructure and affects a covered device or system owned or operated by a ,federal or non-,federal entity1 and the ,director is unable to identify the entity at risk1 the ,director may issue a subpoena for the production of information necessary to identify and notify the entity at risk1 in order to carry out a function authorized under subsection 7c77#ab74 7,b7 ,limit on information ,a subpoena issued under the authority under subparagraph 7,a7 may seek information-- 7i7 only in the categories set forth in subparagraphs 7,a71 7,b71 7,d71 and 7,e7 of section #bgjc7;c77#b7 of title #ah1 ,united ,states ,code2 and 7ii7 for not more than #bj covered devices or systems4 7,c7 ,liability protections for disclosing providers ,the provisions of section #bgjc7;e7 of title #ah1 ,united ,states ,code1 shall apply to any subpoena issued under the authority under subparagraph 7,a74 7#c7 ,coordination 7,a7 ,in general ,if the ,director decides to exercise the subpoena authority under this subsection1 and in the interest of avoiding interference with ongoing law enforcement investigations1 the ,director shall coordinate the issuance of any such subpoena with the ,department of ,justice1 including the ,federal ,bureau of ,investigation1 pursuant to inter-agency procedures which the ,director1 in coordination with the ,attorney ,general1 shall develop not later than #fj days after the date of enactment of this subsection4 7,b7 ,contents ,the inter-agency procedures developed under this paragraph shall provide that a subpoena issued by the ,director under this subsection shall be-- 7i7 issued in order to carry out a function described in subsection 7c77#ab72 and 7ii7 subject to the limitations under this subsection4 7#d7 ,noncompliance ,if any person1 partnership1 corporation1 association1 or entity fails to comply with any duly served subpoena issued under this subsection1 the ,director may request that the ,attorney ,general seek enforcement of the subpoena in any judicial district in which such person1 partnership1 corporation1 association1 or entity resides1 is found1 or transacts business4 7#e7 ,notice ,not later than #g days after the date on which the ,director receives information obtained through a subpoena issued under this subsection1 the ,director shall notify any entity identified by information obtained under the subpoena regarding the subpoena and the identified vulnerability4 7#f7 ,authentication 7,a7 ,in general ,any subpoena issued by the ,director under this subsection shall be authenticated with a cryptographic digital signature of an authorized representative of the ,agency1 or other comparable successor technology1 that allows the recipient of the subpoena to determine that the subpoena was issued by the ,agency and has not been altered or modified since it was issued by the ,agency4 7,b7 ,invalid if not authenticated ,any subpoena issued by the ,director under this subsection that is not authenticated in accordance with subparagraph 7,a7 shall not be considered to be valid by the recipient of the subpoena4 7#g7 ,procedures ,not later than #ij days after the date of enactment of this subsection1 the ,director shall establish internal procedures and associated training1 applicable to employees and operations of the ,agency1 regarding subpoenas issued under this subsection1 which shall address-- 7,a7 the protection of and restriction on dissemination of nonpublic information obtained through a subpoena issued under this subsection1 including a requirement that the ,agency shall not disseminate nonpublic information obtained through a subpoena issued under this subsection that identifies the party that is subject to the subpoena or the entity at risk identified by information obtained1 except that the ,agency may share the nonpublic information of the entity at risk with another ,federal agency if-- 7i7 the ,agency identifies or is notified of a cybersecurity incident involving the entity1 which relates to the vulnerability which led to the issuance of the subpoena2 7ii7 the ,director determines that sharing the nonpublic information with another ,federal agency is necessary to allow that ,federal agency to take a law enforcement or national security action or actions related to mitigating or otherwise resolving such incident2 7iii7 the entity to which the information pertains is notified of the ,director's determination1 to the extent practicable consistent with national security or law enforcement interests2 and 7iv7 the entity consents1 except that the entity's consent shall not be required if another ,federal agency identifies the entity to the ,agency in connection with a suspected cybersecurity incident2 7,b7 the restriction on the use of information obtained through the subpoena for a cybersecurity purpose1 as defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja72 7,c7 the retention and destruction of nonpublic information obtained through a subpoena issued under this subsection1 including-- 7i7 destruction of information obtained through the subpoena that the ,director determines is unrelated to critical infrastructure immediately upon providing notice to the entity pursuant to paragraph 7#e72 and 7ii7 destruction of any personally identifiable information not later than #f months after the date on which the ,director receives information obtained through the subpoena1 unless otherwise agreed to by the individual identified by the subpoena respondent2 7,d7 the processes for providing notice to each party that is subject to the subpoena and each entity identified by information obtained under a subpoena issued under this subsection2 7,e7 the processes and criteria for conducting critical infrastructure security risk assessments to determine whether a subpoena is necessary prior to being issued under this subsection2 and 7,f7 the information to be provided to an entity at risk at the time of the notice of the vulnerability1 which shall include-- 7i7 a discussion or statement that responding to1 or subsequent engagement with1 the ,agency1 is voluntary2 and 7ii7 to the extent practicable1 information regarding the process through which the ,director identifies security vulnerabilities4 7#h7 ,review of procedures ,not later than #a year after the date of enactment of this subsection1 the ,privacy ,officer of the ,agency shall-- 7,a7 review the procedures developed by the ,director under paragraph 7#g7 to ensure that-- 7i7 the procedures are consistent with fair information practices2 and 7ii7 the operations of the ,agency comply with the procedures2 and 7,b7 notify the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives of the results of the review4 7#i7 ,publication of information ,not later than #abj days after establishing the internal procedures under paragraph 7#g71 the ,director shall publish information on the website of the ,agency regarding the subpoena process under this subsection1 including regarding-- 7,a7 the purpose for subpoenas issued under this subsection2 7,b7 the subpoena process2 7,c7 the criteria for the critical infrastructure security risk assessment conducted prior to issuing a subpoena2 7,d7 policies and procedures on retention and sharing of data obtained by subpoena2 7,e7 guidelines on how entities contacted by the ,director may respond to notice of a subpoena2 and 7,f7 the procedures and policies of the ,agency developed under paragraph 7#g74 7#aj7 ,annual reports ,the ,director shall annually submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report 7which may include a classified annex but with the presumption of declassification7 on the use of subpoenas under this subsection by the ,director1 which shall include-- 7,a7 a discussion of-- 7i7 the effectiveness of the use of subpoenas to mitigate critical infrastructure security vulnerabilities2 7ii7 the critical infrastructure security risk assessment process conducted for subpoenas issued under this subsection2 7iii7 the number of subpoenas issued under this subsection by the ,director during the preceding year2 7iv7 to the extent practicable1 the number of vulnerable covered devices or systems mitigated under this subsection by the ,agency during the preceding year2 and 7v7 the number of entities notified by the ,director under this subsection1 and their response1 during the previous year2 and 7,b7 for each subpoena issued under this subsection-- 7i7 the source of the security vulnerability detected1 identified1 or received by the ,director2 7ii7 the steps taken to identify the entity at risk prior to issuing the subpoena2 and 7iii7 a description of the outcome of the subpoena1 including discussion on the resolution or mitigation of the critical infrastructure security vulnerability4 7#aa7 ,publication of the annual reports ,the ,director shall publish a version of the annual report required by paragraph 7#aj7 on the website of the ,agency1 which shall1 at a minimum1 include the findings described in clauses 7iii71 7iv7 and 7v7 of paragraph 7#aj77;,a74 7#ab7 ,prohibition on use of information for unauthorized purposes ,any information obtained pursuant to a subpoena issued under this subsection shall not be provided to any other ,federal agency for any purpose other than a cybersecurity purpose1 as defined in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 4 7b7 ,rules of construction 7#a7 ,prohibition on new regulatory authority ,nothing in this ,act or the amendments made by this ,act shall be construed to grant the ,secretary of ,homeland ,security 7in this subsection referred to as the ,secretary71 or another ,federal agency1 any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the date of enactment of this ,act4 7#b7 ,private entities ,nothing in this ,act or the amendments made by this ,act shall be construed to require any private entity-- 7,a7 to request assistance from the ,secretary2 or 7,b7 that requested such assistance from the ,secretary to implement any measure or recommendation suggested by the ,secretary4 ,july #bi1 #bjbj,reported with an amendment