[Congressional Bills 114th Congress]
[From the U.S. Government Publishing Office]
[H.R. 3039 Introduced in House (IH)]

114th CONGRESS
  1st Session
                                H. R. 3039

 To impose penalties on state-sponsors of cyberattacks, and for other 
                               purposes.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                             July 13, 2015

Mr. Brooks of Alabama introduced the following bill; which was referred 
to the Committee on Foreign Affairs, and in addition to the Committees 
  on Ways and Means, Financial Services, and Oversight and Government 
 Reform, for a period to be subsequently determined by the Speaker, in 
   each case for consideration of such provisions as fall within the 
                jurisdiction of the committee concerned

_______________________________________________________________________

                                 A BILL


 
 To impose penalties on state-sponsors of cyberattacks, and for other 
                               purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Providing Retaliation Options 
against Those Engaging in Cyberattacks Targeting the United States 
Act'' or ``PROTECT US Act''.

SEC. 2. FINDINGS.

    Congress finds the following:
            (1) Article XXI of the GATT 1994 (as such term is defined 
        in section 2(1)(B) of the Uruguay Round Agreements Act (19 
        U.S.C. 3501(1)(B))) allows a member of the World Trade 
        Organization to take any action which such member considers 
        necessary for the protection of such member's essential 
        security interests.
            (2) Protecting the United States from malicious cyber-
        enabled activities is essential to the security interests of 
        the United States.

SEC. 3. IMPOSITION OF PENALTIES ON STATE-SPONSORS OF CYBERATTACKS.

    (a) In General.--The President is authorized to impose penalties 
described in subsection (c) with respect to each country on the list 
required by subsection (b).
    (b) List of State-Sponsors of Cyberattacks.--
            (1) In general.--Not later than 60 days after the date of 
        the enactment of this Act, the President shall submit to 
        Congress a list of countries designated as state-sponsors of 
        cyberattacks pursuant to paragraph (2).
            (2) Countries designated.--If the President, in 
        consultation with the Secretary of Homeland Security, the 
        Secretary of Defense, the Attorney General, and the Chairman of 
        the United States International Trade Commission, determines 
        that the United States or a United States person has been 
        targeted in a malicious cyber-enabled activity originating 
        from, or directed by a person located, in whole or in 
        substantial part, in a foreign country, and such activity is 
        reasonably likely to result in, or have materially contributed 
        to, a threat to the national security or foreign policy of the 
        United States, or harmed the economic health or financial 
        stability of the United States or a United States person, or 
        has the purpose or effect of--
                    (A) harming or otherwise significantly compromising 
                the provision of services by a computer or network of 
                computers that support the United States or a United 
                States person in a critical infrastructure sector,
                    (B) significantly compromising the provision of 
                services by the United States or a United States person 
                in a critical infrastructure sector,
                    (C) causing significant disruption to the 
                availability of a computer or network of computers 
                owned or operated by the United States or a United 
                States person, or
                    (D) causing a significant misappropriation of funds 
                or economic resources, trade secrets, personally 
                identifiable information, or financial information of 
                the United States or a United States person,
        the President shall designate such country as a state-sponsor 
        of cyberattacks.
            (3) Updates of list.--The President shall submit to 
        Congress an updated list under paragraph (1) as new information 
        becomes available.
    (c) Penalties.--
            (1) Trade-related penalty.--The President may impose a 
        duty, in addition to any other duty imposed, on any article or 
        service imported directly or indirectly into the United States 
        that is produced in whole or in part in a country that is 
        included on the list of state-sponsors of cyberattacks required 
        by subsection (b).
            (2) Other actions.--The President may take any of the 
        following actions with respect to a country that is included on 
        the list of state-sponsors of cyberattacks required by 
        subsection (b):
                    (A) A private demarche.
                    (B) An official public demarche.
                    (C) A public condemnation.
                    (D) A public condemnation within one or more 
                multilateral fora.
                    (E) The delay or cancellation of one or more 
                scientific exchanges.
                    (F) The delay or cancellation of one or more 
                cultural exchanges.
                    (G) The denial of one or more working, official, or 
                state visits.
                    (H) The delay or cancellation of one or more 
                working, official, or state visits.
                    (I) The withdrawal, limitation, or suspension of 
                United States development assistance under chapter 1 of 
                part I of the Foreign Assistance Act of 1961.
                    (J) Directing the Export-Import Bank of the United 
                States, the Overseas Private Investment Corporation, or 
                the Trade and Development Agency to not approve the 
                issuance of any (or a specified number of) guarantees, 
                insurance, extensions of credit, or participations in 
                extensions of credit.
                    (K) The withdrawal, limitation, or suspension of 
                United States security assistance under part II of the 
                Foreign Assistance Act of 1961.
                    (L) Consistent with section 701 of the 
                International Financial Institutions Act, directing the 
                United States Executive Directors at international 
                financial institutions to oppose and vote against loans 
                primarily benefitting the country.
                    (M) Ordering the heads of the appropriate United 
                States agencies to not issue any (or a specified number 
                of) specific licenses, and to not grant any other 
                specific authority (or a specified number of 
                authorities), to export any goods or technology to such 
                country under--
                            (i) the Export Administration Act of 1979 
                        (as continued in effect pursuant the 
                        International Emergency Economic Powers Act);
                            (ii) the Arms Export Control Act;
                            (iii) the Atomic Energy Act of 1954; or
                            (iv) any other statute that requires the 
                        prior review and approval of the United States 
                        Government as a condition for the export or re-
                        export of goods or services.
                    (N) Prohibiting any United States financial 
                institution from making loans or providing credits.
                    (O) Prohibiting the United States Government from 
                procuring, or entering into any contract for the 
                procurement of, any goods or services.
                    (P) Suspension or withdrawal of extension of 
                nondiscriminatory treatment to the products of the 
                country pursuant to section 404 of the Trade Act of 
                1974.
                    (Q) Ordering a trade embargo.
                    (R) Ordering a cyber counterattack.
    (d) Removal From List.--
            (1) In general.--A country may be removed from the list of 
        state-sponsors of cyberattacks required by subsection (b) if--
                    (A) the President determines that the country no 
                longer meets the requirements for designation as a 
                state-sponsor of cyberattacks under subsection (b)(2); 
                or
                    (B) Congress enacts a law that provides for such 
                removal.
            (2) Moratorium.--
                    (A) In general.--A country that has been removed 
                from the list pursuant to paragraph (1)(B) may not be 
                added back to the list by the President until at least 
                the date that is one year after the date of such 
                removal.
                    (B) Rule of construction.--Nothing in this 
                paragraph shall be construed as prohibiting Congress 
                from adding a country that has been removed from the 
                list pursuant to paragraph (1)(B) back to the list by a 
                date that is earlier than the date described in 
                subparagraph (A).
    (e) Definitions.--In this section:
            (1) Critical infrastructure sector.--The term ``critical 
        infrastructure sector'' means any of the designated critical 
        infrastructure sectors identified in Presidential Policy 
        Directive 21.
            (2) Entity.--The term ``entity'' means a partnership, 
        association, trust, joint venture, corporation, group, 
        subgroup, government, or other organization.
            (3) List.--The term ``list'' means the list of state-
        sponsors of cyberattacks.
            (4) Misappropriation.--The term ``misappropriation'' means 
        any taking or obtaining by improper means, without permission 
        or consent, or under false pretenses.
            (5) Person.--The term ``person'' means a natural person or 
        an entity.
            (6) United states person.--The term ``United States 
        person'' shall be broadly construed to include but not be 
        limited to any United States citizen, permanent resident alien, 
        entity organized under the laws of the United States or any 
        jurisdiction within the United States (including foreign 
        branches), any governmental or quasi-governmental entity 
        existing in the United States, or any other person in the 
        United States.
                                 <all>