,,ii #aaith ,,congress #b;d ,session ,s4 #eeda ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #bd1 #bjbf,mr4 ,markey introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to establish the ,cybersecurity and ,,ai ,board of ,investigations1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cybersecurity and ,,ai ,board of ,investigations ,act of #bjbf4 #b4 ,findings2 purpose 7a7 ,findings ,congress finds the following3 7#a7 ,robust cybersecurity infrastructure and institutions are integral to national security and economic security4 7#b7 ,cyber threats have become more pervasive and potentially more disruptive with continued digitization across economic sectors4 7#c7 ,the advancement and increased accessibility of artificial intelligence can strengthen cybersecurity controls while also increasing the volume and sophistication of cyber threats4 7#d7 ,critical infrastructure sectors1 such as clean and wastewater utilities and telecommunications networks1 are susceptible to artificial intelligence-enabled cyber incidents4 7#e7 ,as artificial intelligence systems continue to evolve1 these trends in cybersecurity threats will accelerate4 7#f7 ,other emerging technologies1 including quantum computing1 are likely to pose additional1 novel cybersecurity threats that will compound on artificial intelligence-driven risks4 7#g7 ,the ,federal ,government has an interest in understanding cyber incidents in this shifting threat landscape and advancing best practices in cybersecurity4 7b7 ,purpose ,the purposes of this ,act are-- 7#a7 to establish the ,cybersecurity and ,,ai ,board of ,investigations2 and 7#b7 to bolster the cyber defenses of public and private institutions in responding to the cyber risks posed by artificial intelligence and other emerging technologies4 #c4 ,cybersecurity and ,,ai ,board of ,investigations 7a7 ,definitions ,in this section3 7#a7 ,artificial intelligence ,the term artificial intelligence has the meaning given the term in section #bch7;g7 of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjai 7#aj ,u4,s4,c4 note prec4 #djfa2 ,public ,law #aae-bcb74 7#b7 ,board ,the term ,board means the ,cybersecurity and ,,ai ,board of ,investigations established under subsection 7b77#a74 7#c7 ,chair ,the term ,chair means the ,chair of the ,board designated under subsection 7c77#c77;,a77i74 7#d7 ,cybersecurity purpose2 cybersecurity threat2 information system2 security control2 security vulnerability ,the terms cybersecurity purpose1 cybersecurity threat1 information system1 security control1 and security vulnerability have the meanings given those terms in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#e7 ,federal agency ,the term ,federal agency means any executive department1 military department1 ,government-controlled corporation1 or other establishment in the executive branch of the ,federal ,government1 including the ,executive ,office of the ,president or any independent regulatory agency4 7#f7 ,federal civilian executive branch agency 7,a7 ,in general ,except as provided in subparagraph 7,b71 the term ,federal civilian executive branch agency means a ,federal agency4 7,b7 ,exception ,the term ,federal civilian executive branch agency does not include the ,department of ,defense or any ,federal agency that is an element of the intelligence community1 as defined in section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d774 7#g7 ,federal civilian executive branch information system 7,a7 ,in general ,except as provided in subparagraph 7,b71 the term ,federal civilian executive branch information system means any information system operated by a ,federal civilian executive branch agency4 7,b7 ,exception ,the term ,federal civilian executive branch information system does not include-- 7i7 a national security system1 as defined in section #ceeb7;b7 of title #dd1 ,united ,states ,code2 or 7ii7 a system described in paragraph 7#b7 or 7#c7 of section #ceec7;e7 of title #dd1 ,united ,states ,code4 7#h7 ,incident ,the term incident means an occurrence that actually or imminently jeopardizes1 without lawful authority-- 7,a7 the integrity1 confidentiality1 or availability of information on an information system2 or 7,b7 an information system4 7#i7 ,near-miss ,the term near-miss means a circumstance-- 7,a7 in which a known or newly discovered security vulnerability is exploited in an attempt to jeopardize the integrity1 confidentiality1 or availability of information on an information system2 and 7,b7 through which no harm amounting to a significant cyber incident1 as defined by the ,board1 is realized4 7#aj7 ,relevant congressional committees ,the term relevant congressional committees means-- 7,a7 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate2 7,b7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,c7 the ,committee on ,energy and ,commerce of the ,house of ,representatives2 and 7,d7 the ,committee on ,homeland ,security of the ,house of ,representatives4 7b7 ,establishment2 purposes2 organization 7#a7 ,establishment ,on the date that is #ij days after the date of enactment of this ,act1 there is established as an independent establishment1 as defined in section #ajd of title #e1 ,united ,states ,code1 the ,cybersecurity and ,,ai ,board of ,investigations4 7#b7 ,charter ,the ,board established under paragraph 7#a7 shall establish a charter1 which shall be made publicly available1 that includes non-exhaustive criteria for1 and inform the prioritization of1 the work of the ,board1 including-- 7,a7 initiating reviews and assessments of incidents2 7,b7 conducting trend analyses2 and 7,c7 placing a limitation on incidents eligible for review to incidents for which all evidence1 factual findings1 and recommendations are unclassified or declassified to the best knowledge of the ,board at the time of selection4 7#c7 ,purposes ,the purposes of the ,board are to-- 7,a7 advance the safety1 reliability1 and resilience of the digital and communications infrastructure of the ,united ,states1 which supports commerce1 innovation1 and public safety2 7,b7 conduct independent and impartial reviews and assessments with respect to-- 7i7 incidents affecting ,federal civilian executive branch information systems or non-,federal information systems1 particularly such systems that support critical infrastructure sectors2 7ii7 near-misses in which a significant cybersecurity incident was narrowly averted2 7iii7 systemic cybersecurity vulnerabilities across sectors1 vendors1 or technology categories1 including within the artificial intelligence sector1 that give rise to incidents affecting relevant ,federal civilian executive branch and non-,federal information systems2 and 7iv7 breakdowns in regulatory oversight1 coordination1 or response processes with respect to incidents and systemic risks affecting critical infrastructure sectors2 7,c7 identify contributing technical1 organizational1 and systemic failures relating to each review and assessment conducted under subparagraph 7,b7 in order to produce actionable recommendations for implicated public and private entities on improving the resilience of the ,united ,states with respect to cybersecurity threats and security vulnerabilities2 7,d7 in coordination with the ,director of the ,national ,institute of ,standards and ,technology and the ,assistant ,secretary of ,commerce for ,communications and ,information1 establish and maintain the near-miss system established under paragraph 7#d7 to collect and analyze confidential reports of incidents and near-misses from public and private entities for the purpose of improving the resilience of the ,united ,states with respect to security vulnerabilities2 7,e7 facilitate learning and transparency across the public and private sectors by publicly releasing timely reports of the reviews and assessments conducted under subparagraph 7,b72 7,f7 issue trend analyses with respect to recurring cybersecurity threats1 security vulnerabilities1 and systemic risk patterns1 with attention paid to the novel and intensified risks relating to the continued development and adoption of artificial intelligence2 7,g7 maintain a historical record of major incidents and contributing risk patterns with respect to those major incidents to promote the proactive reduction of cybersecurity threats and security vulnerabilities across critical infrastructure sectors2 and 7,h7 operate independently from regulatory review and enforcement actions without assigning legal fault or liability for any review and assessment conducted under subparagraph 7,b74 7#d7 ,offices1 bureaus1 and divisions of the ,board ,the ,board shall establish such distinct and appropriately staffed offices1 bureaus1 and divisions as may be necessary to carry out this section and investigate and report on incidents1 which shall include the following3 7,a7 ,the ,office of ,investigations1 which shall be responsible for-- 7i7 conducting investigations into significant incidents1 failures of information systems1 intrusions into information systems1 and near-misses2 7ii7 developing the factual record necessary for the ,board to determine the causes of1 and contributing factors to1 the matters described in clause 7i72 and 7iii7 supporting the development of reports1 findings1 and recommendations of the ,board under this section4 7,b7 ,the ,office of ,trend ,analysis and ,learning1 which shall be responsible for-- 7i7 administering the near-miss reporting system established under paragraph 7#e71 which may inform wider trend analyses2 7ii7 issuing public trend reports to promote proactive reduction of cybersecurity threats and security vulnerabilities across critical infrastructure sectors2 and 7iii7 conducting ongoing analysis of the novel and intensifying cybersecurity risks posed by emerging technologies1 including artificial intelligence4 7,c7 7i7 ,the ,office of ,coordination1 which shall be responsible for-- 7,i7 serving as the principal liaison between the ,board and ,federal agencies1 including for the purpose of facilitating secure information sharing and coordination during investigations conducted by the ,board2 7,,ii7 serving as the principal liaison between the ,board and private sector entities2 and 7,,iii7 coordinating with the ,office of ,investigations to ensure timely and efficient access to relevant ,federal1 ,state1 local1 and private sector personnel1 systems1 and information for the purposes of an investigation conducted by the ,board2 and 7ii7 ,the ,office of ,coordination shall establish separate internal functional units1 as appropriate1 to manage coordination with ,federal entities and coordination with private sector entities1 respectively1 in order to ensure clear channels of communication and preserve the independence of investigative activities conducted by the ,board4 7#e7 ,voluntary near-miss reporting system ,the ,board shall establish a voluntary1 anonymized near-miss reporting system1 which shall-- 7,a7 allow individuals and organizations to confidentially report near-misses within critical infrastructure sectors1 including events that could have disrupted critical communications or commerce systems or exposed private data2 7,b7 protect from disclosure the identity of each individual or organization submitting a report under subparagraph 7,a72 7,c7 be designed to identify systemic security vulnerabilities across technologies1 sectors1 and governance models2 and 7,d7 support proactive risk management and learning without attribution of fault or liability4 7c7 ,membership 7#a7 ,board members 7,a7 ,in general ,the ,board shall be composed of #e members1 each of whom shall be appointed-- 7i7 by the ,president1 by and with the advice and consent of the ,senate2 and 7ii7 on the basis of technical qualification1 professional standing1 and demonstrated knowledge in cybersecurity or related fields4 7,b7 ,limitation ,not more than #c members of the ,board may be members of the same political party4 7#b7 ,terms of office and removal 7,a7 ,in general ,each member of the ,board shall hold office for a term of #e years4 7,b7 ,vacancies ,a member of the ,board appointed to fill a vacancy occurring before the expiration of the term for which the predecessor of that member was appointed shall be appointed for the remainder of that term4 7,c7 ,end of term ,when the term of office of a member of the ,board ends1 the member may continue to serve until a successor is appointed pursuant to paragraph 7#a77;,a74 7,d7 ,removal ,the ,president may remove a member of the ,board for inefficiency1 neglect of duty1 or malfeasance in office4 7,e7 ,pay ,each member of the ,board shall be paid an annual rate of basic pay not to exceed the rate paid for a position at level ,,iv of the ,executive ,schedule under section #ecae of title #e1 ,united ,states ,code4 7#c7 ,chair and ,vice ,chair 7,a7 ,chair 7i7 ,in general ,the ,president shall designate1 by and with the advice and consent of the ,senate1 a ,chair of the ,board4 7ii7 ,duties and powers ,the ,chair shall-- 7,i7 serve as the chief executive and administrative officer of the ,board2 and 7,,ii7 subject to the general policies and decisions of the ,board-- 7aa7 appoint and supervise officers and employees1 other than regular and full-time employees of the offices of other members of the ,board1 necessary to carry out this section2 7bb7 fix the pay of officers and employees who are appointed to carry out this section2 7cc7 distribute business among the officers1 employees1 and administrative units of the ,board2 and 7dd7 supervise the expenditures of the ,board4 7,b7 ,vice ,chair ,the ,president shall designate a ,vice ,chair of the ,board1 by and with the advice and consent of the ,senate4 7,c7 ,terms ,the ,chair and ,vice ,chair shall each hold office for a term of #c years4 7,d7 ,vacancy ,when the ,chair is absent or unable to serve1 or when the position of ,chair is vacant1 the ,vice ,chair shall serve as ,chair4 7#d7 ,personnel matters 7,a7 ,in general ,subject to subparagraph 7,b71 each member of the ,board shall appoint and supervise employees in the office of that member1 provided that each such employee has been approved for employment with the ,board by the designated agency ethics official with respect to the ,board under the same guidelines that apply to all employees of the ,board4 7,b7 ,limitation ,except with respect to the office of the ,chair of the ,board1 the authority under subparagraph 7,a7 shall be limited to the number of full-time equivalent positions 7plus #a senior professional position1 the annual rate of basic pay of which shall be not greater than that for step #aj of grade #ae of the ,general ,schedule71 as allocated annually by the ,chair of the ,board through the internal staffing plan of the ,board4 7d7 ,convening the ,board 7#a7 ,in general ,the ,board-- 7,a7 shall meet not fewer than #d times each calendar year at a time and date to be determined by the ,chair2 and 7,b7 may meet at additional times at the call of the ,chair4 7#b7 ,quorum ,three members of the ,board shall constitute a quorum for conducting the business of the ,board4 7e7 ,review and assessment2 reports 7#a7 ,initiation of review ,the ,board may initiate a review and assessment described in subsection 7b77#b77;,b7 upon a majority vote of all members of the ,board1 the results of which shall be made publicly available4 7#b7 ,commencement of review and assessment ,in addition to a meeting of the ,board convened under subsection 7d71 the ,chair may1 at any time1 call a meeting of the ,board to initiate a review and assessment described in subsection 7b77#c77;,b74 7#c7 ,reports ,upon completing each review and assessment described in subsection 7b77#c77;,b71 the ,board shall prepare a report with respect to the event that is the subject of the review and assessment that-- 7,a7 contains factual findings and actionable recommendations for improving cybersecurity practices1 systemic resilience1 incident response practices and policies1 and coordination across public and private entities2 7,b7 includes-- 7i7 a timeline of relevant events2 7ii7 an analysis of contributing technical1 organizational1 and systemic factors with respect to the applicable event2 7iii7 a section relating to insights and lessons learned that-- 7,i7 identifies-- 7aa7 factors that enhanced or impeded the review and assessment by the ,board2 and 7bb7 any gaps in authorities1 tools1 or interagency coordination2 and 7,,ii7 contains recommendations to improve the future operations of the ,board2 7iv7 appendices that include-- 7,i7 technical indicators of compromise1 such as data points or artifacts that identify or describe the methods used in an incident2 and 7,,ii7 detailed methodological information with respect to the analytical processes1 tools1 and technical methods used to conduct each review and assessment described in subsection 7b77#c77;,b72 and 7v7 a plain language executive summary of the matters described in this paragraph1 which shall be accessible to a non-technical audience2 and 7,c7 is informed by and composed of only unclassified or declassified information and information appropriate for public consumption4 7#d7 ,updates ,the insights and lessons learned described in paragraph 7#c77;,b77iii7 shall-- 7,a7 inform updates to ,board procedures1 training1 and coordination protocols2 and 7,b7 be shared across the ,federal cybersecurity ecosystem to improve interagency readiness4 7#e7 ,public availability ,the ,board shall-- 7,a7 submit to the relevant congressional committees each report prepared under paragraph 7#c71 consistent with the protections for documents and testimony voluntarily provided to the ,board under subsection 7i77#b72 and 7,b7 make each report prepared under paragraph 7#c7 publicly available1 consistent with the protections for documents and testimony voluntarily provided to the ,board under subsection 7i77#b74 7#f7 ,responses ,not later than #ij days after the date on which the ,board issues a report prepared under paragraph 7#c7 that includes a recommendation applying to a ,federal civilian executive branch agency1 each such ,federal civilian executive branch agency shall respond in writing to that recommendation1 even when the ,federal civilian executive branch agency does not follow the recommended course of action1 to allow the ,board to track the progress of implementation across all of the recommendations of the ,board4 7f7 ,personnel 7#a7 ,in general ,the ,board shall be supported by a permanent1 full-time ,federal staff1 which may include positions as-- 7,a7 lead investigators2 7,b7 malware analysts2 7,c7 system engineers2 7,d7 legal counsel2 7,e7 digital forensic experts2 7,f7 communications professionals and technical writers2 and 7,g7 other subject matter experts1 as determined necessary by the ,chair4 7#b7 ,additional staff ,in addition to the staff described in paragraph 7#a71 a member of the ,board may nominate personal support staff to assist in the work of the ,board1 subject to applicable background checks1 security clearances1 and financial disclosure requirements4 7#c7 ,personnel flexibility ,to increase the capabilities of the ,board1 the ,board may-- 7,a7 enter into agreements with federally funded research and development centers2 7,b7 appoint special ,government employees1 as defined in section #bjb7;a7 of title #ah1 ,united ,states ,code2 and 7,c7 as necessary1 contract with private sector or academic experts to serve as investigators4 7g7 ,exemption from certain laws ,the ,board shall not be subject to-- 7#a7 chapter #aj of title #e1 ,united ,states ,code 7commonly known as the ,federal ,advisory ,committee ,act72 or 7#b7 section #eeb;b of title #e1 ,united ,states ,code 7commonly known as the ,government in the ,sunshine ,act74 7h7 ,board management 7#a7 ,in general ,to ensure that the ,board fulfills the purposes described in subsection 7b77#c71 the ,chair shall take all necessary actions to manage the affairs of the ,board and the conduct of the reviews and assessments described in subsection 7b77#c77;,b71 which shall include-- 7,a7 developing and promulgating1 with the approval of the ,board1 a charter and other bylaws and internal procedures concerning the work of the ,board1 including non-exhaustive criteria for defining a significant cybersecurity incident and selecting incidents for investigation1 all of which shall be made public2 and 7,b7 making contracts and entering into agreements with ,federal departments and ,federal agencies as necessary and appropriate to carry out the responsibilities of the ,board1 including by coordinating with the ,secretary of ,commerce1 the ,director of the ,national ,institute of ,standards and ,technology1 and the ,assistant ,secretary of ,commerce for ,communications and ,information4 7#b7 ,party system 7,a7 ,in general ,the ,chair may adopt a party participation system under which an organization affected by a matter that is subject to a review and assessment described in subsection 7b77#c77;,b71 including any entity operating or providing digital communications1 technology products1 or critical infrastructure services implicated in that matter1 may provide factual input for investigators of the ,board4 7,b7 ,level of participation ,a party that provides factual input under subparagraph 7,a7 may not participate in drafting findings or shaping recommendations contained in1 or reviewing1 a final report of the ,board before publication of that report4 7#c7 ,conflicts of interest ,the ,chair shall implement a system to identify1 mitigate1 and manage any conflicts of interest that may arise as a result of participation by an individual in the work of the ,board under this section4 7i7 ,requests for information and administrative subpoenas 7#a7 ,purpose ,in order to ensure that the ,board has sufficient information to conduct the reviews and assessments required under subsection 7e7 and issue reports under that subsection1 the ,chair1 or an appropriate designee of the ,chair1 may request and receive relevant documents 7including in electronic form7 and testimony from1 and issue subpoenas ad testificandum and subpoenas duces tecum to-- 7,a7 any entity or individual affected by the incident or issue giving rise to a review and assessment under subsection 7e72 7,b7 any entity that1 or individual who1 responded to the incident or issue described in subparagraph 7,a72 or 7,c7 any other entity or individual that the ,board reasonably believes may have information relevant to the review and assessment carried out1 or report issued1 under subsection 7e74 7#b7 ,voluntary provision of information 7,a7 ,in general ,any entity or individual may voluntarily provide the ,board with documents1 including in electronic form1 and testimony relevant to a review and assessment carried out1 or report issued1 by the ,board under subsection 7e71 with or without a ,board request for those documents or that testimony4 7,b7 ,board request for information ,if the ,chair has reason to believe that an entity or individual has information relevant to an incident under review by the ,board under subsection 7e71 the ,chair1 or an appropriate designee of the ,chair1 may request that information from the entity or individual4 7,c7 ,treatment of information provided in response to a ,board request ,any document1 including in electronic form1 or testimony provided to the ,board in response to a request under subparagraph 7,b7 shall be-- 7i7 treated as voluntarily provided2 and 7ii7 subject to the protections set forth under subsection 7j74 7#c7 ,subpoena authority 7,a7 ,in general ,if the ,chair1 or an appropriate designee of the ,chair1 determines that the response1 or lack of a response1 by an entity or an individual to a request made under paragraph 7#b77;,b7 is deficient1 the ,chair1 or an appropriate designee of the ,chair1 may1 subject to approval under subparagraph 7,b77i7 of this paragraph1 issue a subpoena to compel the disclosure of documents1 including in electronic form1 and testimony relevant to an incident under ,board review under subsection 7e74 7,b7 ,procedures 7i7 ,in general ,before the issuance of a subpoena under subparagraph 7,a71 a simple majority of the members of the ,board must approve the issuance of the subpoena4 7ii7 ,considerations ,in evaluating whether to approve a subpoena under subparagraph 7,a71 the members of the ,board shall consider factors including-- 7,i7 whether the ,board is able to obtain the documents1 including in electronic form1 or testimony through other non-compulsory means2 7,,ii7 whether further communication with the entity or individual is likely to produce the documents1 including in electronic form1 or testimony on a voluntary basis2 7,,iii7 whether1 based on the nature of the request1 a reasonable amount of time has elapsed to allow the entity or individual to voluntarily provide the documents1 including in electronic form1 or testimony to the ,board2 7,,iv7 the importance of the requested documents1 including in electronic form1 or testimony to the ability of the ,board to complete a full and complete review and assessment or report under subsection 7e72 and 7,v7 whether1 after consultation with relevant ,federal agencies1 the subpoena would affect a regulatory1 law enforcement1 foreign intelligence1 or diplomatic effort of the ,united ,states4 7,c7 ,civil action 7i7 ,in general ,if an entity or individual fails to comply with a subpoena issued under this paragraph1 the ,chair may refer the matter to the ,attorney ,general to bring a civil action in an appropriate district court of the ,united ,states to enforce the subpoena4 7ii7 ,venue ,an action under this subparagraph shall be brought in the judicial district in which the entity against which1 or the individual against whom1 the civil action is brought resides1 is found1 or does business1 or in the ,district of ,columbia4 7iii7 ,contempt of court ,a court may punish a failure to comply with a subpoena issued under this paragraph as contempt of court4 7,d7 ,exclusion for government entities ,this paragraph shall not apply to a ,state1 local1 ,tribal1 territorial1 or ,federal ,government entity1 or to any employee of that entity with respect to matters related to the official duties of the employee4 7,e7 ,delegation of subpoena authority ,the authority of the ,chair to issue a subpoena under this paragraph may only be delegated to another ,board member4 7,f7 ,authentication 7i7 ,in general ,any subpoena issued electronically under this paragraph shall be authenticated with a cryptographic digital signature1 or other comparable successor technology1 of the ,chair or designee of the ,chair1 that allows the ,chair or the designee of the ,chair to demonstrate that the subpoena was issued by the ,chair or the designee of the ,chair and has not been altered or modified since the subpoena was issued4 7ii7 ,invalid if not authenticated ,any subpoena issued electronically pursuant to this paragraph that is not authenticated in accordance with clause 7i7 shall not be considered to be valid by the recipient of the subpoena or by any court4 7,g7 ,preservation ,for purposes of section #bgjc7;f7 of title #ah1 ,united ,states ,code1 the ,board shall be considered to be a governmental entity4 7,h7 ,protections for information obtained by subpoena ,any document1 including in electronic form1 or testimony obtained by a subpoena under this paragraph-- 7i7 shall not be subject to subsection 7j72 and 7ii7 in the discretion of the ,board1 may be protected from public disclosure where otherwise consistent with applicable law4 7#d7 ,stored ,communications ,act ,nothing in this subsection may be construed to permit or require disclosure by a provider of a remote computing service or a provider of an electronic communication service to the public of information not otherwise permitted or required to be disclosed under chapter #aba of title #ah1 ,united ,states ,code 7commonly known as the ,stored ,communications ,act74 7#e7 ,information from ,federal agencies 7,a7 ,requests ,the ,chair1 or an appropriate designee of the ,chair1 may request from any ,federal agency such information as necessary to carry out the duties of the ,board4 7,b7 ,furnishing information ,upon request of the ,chair1 or the appropriate designee of the ,chair1 under subparagraph 7,a71 the head of a ,federal agency shall furnish the applicable information to the ,board4 7j7 ,protections for information voluntarily provided to the ,board 7#a7 ,application ,the protections in this subsection shall apply to any document1 including in electronic form1 or testimony voluntarily provided to the ,board under subsection 7i77#b74 7#b7 ,disclosure1 retention1 and use ,any document1 including in electronic form1 and testimony voluntarily provided to the ,board may be disclosed to1 retained by1 and used by any ,federal agency or department1 component1 officer1 employee1 or agent of the ,federal ,government1 consistent with otherwise applicable provisions of ,federal law1 solely-- 7,a7 for a cybersecurity purpose2 7,b7 to identify-- 7i7 a cybersecurity threat1 including the source of the cybersecurity threat2 or 7ii7 a security vulnerability2 7,c7 to respond to1 or otherwise prevent or mitigate1 a specific threat of death1 a specific threat of serious bodily harm1 or a specific threat of serious economic harm1 including a terrorist act or use of a weapon of mass destruction2 7,d7 to respond to1 investigate1 prosecute1 or otherwise prevent or mitigate1 a serious threat to a minor1 including sexual exploitation and threats to physical safety2 or 7,e7 to prevent1 investigate1 disrupt1 or prosecute an offense arising out of an incident or issue assessed by the ,board1 pursuant to subsection 7e71 or any of the offenses listed in section #aje7;d77#e77;,a77v7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aejd7;d77#e77;,a77v774 7#c7 ,protections for entities and information ,any document1 including in electronic form1 or testimony voluntarily provided to the ,board under subsection 7i77#b7 shall-- 7,a7 be considered the commercial1 financial1 and proprietary information of the providing entity or individual when so designated by that entity or individual2 7,b7 be exempt from disclosure under-- 7i7 section #eeb7;b77#c7 of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act72 and 7ii7 any provision of ,state1 ,tribal1 or local freedom of information law1 open government law1 open meetings law1 open records law1 sunshine law1 or similar law requiring disclosure of information or records2 7,c7 be considered not to constitute a waiver of any applicable privilege or protection provided by law1 including trade secret protection2 and 7,d7 not be subject to a rule of any ,federal agency or any judicial doctrine regarding ex parte communications with a decision-making official4 7#d7 ,liability protections 7,a7 ,in general ,no cause of action arising from the voluntary provision of documents to the ,board under subsection 7i77#b7 shall lie or be maintained in any court by any person1 and any such action shall be promptly dismissed4 7,b7 ,restrictions 7i7 ,in general ,subject to clause 7ii71 no submission voluntarily provided to the ,board under subsection 7i77#b71 or any communication1 document1 material1 or other record1 created for the sole purpose of preparing1 drafting1 or submitting such submission1 may be received in evidence1 subject to discovery1 or otherwise used in any trial1 hearing1 or other proceeding in or before any court1 regulatory body1 or other authority of the ,united ,states1 a ,state1 or a political subdivision of a ,state4 7ii7 ,exception ,this subparagraph shall not prevent the use1 retention1 or disclosure of information in the documents or testimony described in clause 7i7 to investigate or prosecute a person or entity suspected or alleged to have committed1 conspired to commit1 or aided and abetted the commission of1 an incident described in the documents or testimony1 provided that the submission itself is not disclosed4 7,c7 ,rule of construction ,nothing in this paragraph may be construed to create a defense to discovery or otherwise affect the discovery of any communication1 document1 material1 or other record not created for the sole purpose of preparing1 drafting1 or submitting such submission1 except that this paragraph shall not apply to information developed from a source independent of a submission submitted under subsection 7i77#b74 7k7 ,additional privacy and digital security protections 7#a7 ,privacy and civil liberties ,any document1 including in electronic form1 or testimony provided to or obtained by the ,board shall be retained1 used1 and disseminated1 where permissible and appropriate1 by the ,federal ,government in a manner that protects personal information from unauthorized use or unauthorized disclosure4 7#b7 ,digital security ,any document1 including in electronic form1 or testimony provided to or obtained by the ,board shall be collected1 stored1 and protected1 at a minimum1 in accordance with the requirements for moderate impact ,federal information systems1 as described in ,federal ,information ,processing ,standards ,publication #aii of the ,national ,institute of ,standards and ,technology1 or any successor document4