,,ii #aagth ,,congress #b;d ,session ,s4 #dihe ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #bh1 #bjbb,mrs4 ,blackburn 7for herself and ,ms4 ,lummis7 introduced the following bill2 which was read twice and referred to the ,committee on ,banking1 ,housing1 and ,urban ,affairs ,a ,,bill ,to amend the ,cybersecurity ,information ,sharing ,act of #bjae to include voluntary information sharing of cyber threat indicators among cryptocurrency companies1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cryptocurrency ,cybersecurity ,information ,sharing ,act4 #b4 ,sharing of cyber threat indicators by covered companies 7a7 ,in general ,the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq47 is amended-- 7#a7 in section #ajb7ae77;,a7 7#f ,u4,s4,c4 #aeja7ae77;,a77 by inserting covered company 7as defined in section #aaj71 after cooperative12 7#b7 by redesignating sections #aaj and #aaa 7#f ,u4,s4,c4 #aeji1 #aeaj7 as sections #aaa and #aab1 respectively2 and 7#c7 by inserting after section #aji 7#f ,u4,s4,c4 #aejh7 the following3 #aaj4 ,sharing of cyber threat indicators by covered companies 7a7 ,definitions ,in this section3 7#a7 ,covered company 7,a7 ,in general ,subject to subparagraph 7,b71 the term covered company means an entity-- 7i7 that is-- 7,i7 engaged in the business of validating distributed ledger technology transactions2 7,,ii7 engaged in the business of developing digital assets or the corresponding protocols for use of digital assets by other persons2 7,,iii7 an association of entities that manage digital assets or distributed ledger technologies2 or 7,,iv7 a commercial general liability insurance provider or property insurance provider offering products designed to mitigate losses from a variety of cyber incidents1 including-- 7aa7 data breaches2 7bb7 ransomware attacks2 7cc7 business interruption2 and 7dd7 network damage2 and 7ii7 that shares or receives information under this section4 7,b7 ,money services businesses and financial institutions ,for purposes of paragraphs 7#a71 7#b71 and 7#c7 of subsection 7b71 the term covered company includes an entity that is a money services business1 or that otherwise is a financial institution1 as defined in section #ecab of title #ca1 ,united ,states ,code1 for purposes of digital asset activity engaged in by the entity4 7#b7 ,digital asset ,the term digital asset means a natively electronic asset that-- 7,a7 confers economic1 proprietary1 or access rights or powers2 and 7,b7 is recorded using cryptographically secured distributed ledger technology1 or any similar analogue4 7#c7 ,distributed ledger technology ,the term distributed ledger technology means technology that enables the operation and use of a ledger that-- 7,a7 is shared across a set of distributed nodes that participate in a network and store a complete or partial replica of the ledger2 7,b7 is synchronized between the nodes2 7,c7 has data appended to the ledger by following the specified consensus mechanism of the ledger2 7,d7 may be accessible to anyone or restricted to a subset of participants2 and 7,e7 may require participants to have authorization to perform certain actions or require no authorization4 7b7 ,voluntary information sharing among covered companies 7#a7 ,in general ,subject to paragraphs 7#b71 7#c71 and 7#d71 a covered company may1 under the protection of the safe harbor from liability described in subsection 7d71 transmit1 receive1 or otherwise share information with any other covered company regarding individuals1 entities1 organizations1 and countries for purposes of identifying and1 as appropriate1 reporting activities that the covered company suspects may involve possible cyber threat indicators4 7#b7 ,information sharing between covered companies 7,a7 ,notice requirement 7i7 ,in general ,a covered company that intends to share information as described in paragraph 7#a7 shall submit a notice of intent to the ,financial ,crimes ,enforcement ,network and the ,cybersecurity and ,infrastructure ,security ,agency1 which shall contain1 at a minimum1 a list of each other company the covered company intends to share information with4 7ii7 ,effective period ,each notice provided under clause 7i7 shall be effective for the #a-year period beginning on the date of the notice4 7iii7 ,additional notices ,upon expiration of the #a-year period described in subclause 7ii71 a covered company shall submit an additional notice of intent at the beginning of each year during which the covered company intends to share information as described in paragraph 7#a74 7iv7 ,list of covered companies that have submitted notice ,the ,financial ,crimes ,enforcement ,network shall periodically make available a list of covered companies that have submitted a notice under this subparagraph4 7,b7 ,verification requirement ,prior to sharing information as described in paragraph 7#a71 a covered company shall take reasonable steps to verify that the company with which the covered company intends to share information is listed in a notice required under subparagraph 7,a74 7#c7 ,protection and use of information by covered companies 7,a7 ,purpose ,information received by a covered company under this section may not be used for any purpose other than-- 7i7 identifying and1 as appropriate1 reporting on cyber threat indicators2 or 7ii7 assisting the covered company in complying with any requirement of this title4 7,b7 ,procedures for protection of information ,each covered company that engages in the sharing of information under this section shall maintain adequate procedures to protect the security and confidentiality of the information in accordance with the policies and guidelines established under subsection 7c74 7#d7 ,reporting requirements for covered companies 7,a7 ,cybersecurity threat information ,a covered company that identifies cybersecurity threat information requiring immediate attention1 such as suspected terrorist activity1 shall1 as soon as practicable but not later than #cf hours after identifying the information-- 7i7 notify an appropriate law enforcement authority and the ,cybersecurity and ,infrastructure ,security ,agency ,incident ,reporting ,system2 and 7ii7 comply with any other ,federal requirements for reporting suspicious activity4 7,b7 ,suspicious activity 7i7 ,voluntary reporting to federal agencies ,a covered company may voluntarily report suspicious activity to the ,financial ,crimes ,enforcement ,network and the ,cybersecurity and ,infrastructure ,security ,agency under this section4 7ii7 ,rule of construction ,nothing in this subparagraph shall be construed to-- 7,i7 modify the requirements for reporting suspicious activity if a covered company is subject to such regulations2 or 7,,ii7 create new suspicious activity reporting requirements for a covered company that is not currently subject to such a regulation4 7,c7 ,exemption from disclosure ,information shared under this paragraph shall be exempt from disclosure under any provision of ,state1 ,tribal1 or local freedom of information law1 open government law1 open meetings law1 open records law1 sunshine law1 or similar law requiring disclosure of information or records1 in accordance with section #ajd7;d77#d77;,b74 7c7 ,information sharing between covered companies and the ,federal ,government 7#a7 ,policies and procedures 7,a7 ,in general ,not later than #ahj days after the date of enactment of the ,cryptocurrency ,cybersecurity ,information ,sharing ,act1 the ,director of the ,financial ,crimes ,enforcement ,network and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall1 in consultation with the ,national ,cyber ,director and the heads of the appropriate ,federal entities1 jointly develop and make publicly available policies and procedures relating to the receipt by the ,federal ,government of cyber threat indicators shared by covered companies4 7,b7 ,considerations ,in developing the policies and procedures required under subparagraph 7,a71 the ,director of the ,financial ,crimes ,enforcement ,network and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall take into account the requirements described in subsections 7a77#c7 and 7b77#c7 of section #aje4 7,c7 ,compliance with similar procedures ,in the case of a covered company that is required to comply with section #eja of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja7 and the ,payment ,card ,industry ,data ,security ,standard1 and applicable regulations issued thereunder1 the covered company shall be considered to be acting in compliance with the requirements developed under this subsection if the covered company applies the procedures required under such section #eja to information shared under this section4 7#b7 ,guidelines 7,a7 ,in general ,not later than #fj days after the date of enactment of the ,cryptocurrency ,cybersecurity ,information ,sharing ,act1 the ,director of the ,financial ,crimes ,enforcement ,network and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall jointly develop and make publicly available guidance-- 7i7 to assist covered companies and promote sharing of cyber threat indicators with ,federal entities under this section2 and 7ii7 relating to adequate procedures to protect the security and confidentiality of information shared under this section1 as required under subsection 7b77#c77;,b74 7,b7 ,contents ,the guidelines required under subparagraph 7,a7 shall include guidance relating to the following3 7i7 ,identification of types of information that would qualify as a cyber threat indicator under this title and that would be unlikely to include information that-- 7,i7 is not directly related to a cybersecurity threat2 and 7,,ii7 is personal information of a specific individual or information that identifies a specific individual4 7ii7 ,identification of types of information protected under otherwise applicable privacy laws that are unlikely to be directly related to a cybersecurity threat4 7iii7 ,such other matters as the ,director of the ,financial ,crimes ,enforcement ,network and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency consider appropriate for entities sharing cyber threat indicators with ,federal entities under this title4 7#c7 ,compliance with the ,paperwork ,reduction ,act ,in establishing requirements under this subsection1 the ,secretary shall ensure that the requirements comply with chapter #ce of title #dd1 ,united ,states ,code 7commonly known as the 8,paperwork ,reduction ,act074 7d7 ,safe harbor from certain liability ,the liability protections in section #ajf shall not apply to a covered company to the extent the company fails to comply with paragraphs 7#b71 7#c71 and 7#d7 of subsection 7b74 7e7 ,exemption from disclosure ,in accordance with paragraphs 7#c7 and 7#h7 of section #ejb7;e7 of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhjb71 if a covered company voluntarily shares information pursuant to this section1 the covered company shall not be required to provide any affected consumer the notice required under section #ejc of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhjc74 4 7b7 ,conforming amendment ,the table of contents in section #a7;b7 of division ,n of the ,consolidated ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #abi ,stat4 #bice7 is amended by striking the items relating to sections #aaj and #aaa and inserting the following3 ,sec4 #aaj4 ,sharing of cyber threat indicators by covered companies4,sec4 #aaa4 ,exception to limitation on authority of ,secretary of ,defense to disseminate certain information4,sec4 #aab4 ,effective period4 4