117 S2292 IS: Study on Cyber-Attack Response Options Act U.S. Senate 2021-06-24 text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.

II117th CONGRESS1st SessionS. 2292IN THE SENATE OF THE UNITED STATESJune 24, 2021Mr. Daines (for himself and Mr. Whitehouse) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental AffairsA BILLTo require the Secretary of Homeland Security to study the potential consequences and benefits of amending the Computer Fraud and Abuse Act to allow private companies to take proportional actions in response to an unlawful network breach.

1.

Short title

This Act may be cited as the Study on Cyber-Attack Response Options Act.

2.

Study relating to consequences and benefits of amending the CFAA

(a)

Study

The Secretary of Homeland Security, in consultation with other Federal agencies as appropriate, shall conduct a study on the potential benefits and risks of amending section 1030 of title 18, United States Code (commonly known as the Computer Fraud and Abuse Act), to allow private entities to take proportional actions in response to an unlawful network breach, subject to oversight and regulation by a designated Federal agency.(b)

Report

(1)

In general

Not later than 180 days after the date of enactment of this Act, the Secretary of Homeland Security shall submit a report on the findings of the study conducted under subsection (a), including any recommendations, to Congress. (2)

Required contents

The report required under paragraph (1) shall—(A)address any impact on national security and foreign affairs; and(B)include recommendations for—(i)which Federal agency or agencies may authorize proportional actions by private entities; (ii)what level of certainty regarding the identity of the attacker is needed before such actions would be authorized; (iii)which entities would be allowed to take such actions and under what circumstances; (iv)what actions would be permissible; and(v)what safeguards should be in place.