[Congressional Record Volume 161, Number 124 (Monday, August 3, 2015)]
[Senate]
[Pages S6243-S6244]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
SA 2546. Ms. COLLINS (for herself, Mr. Warner, Ms. Mikulski, Mr.
Coats, Ms. Ayotte, and Mrs. McCaskill) submitted an amendment intended
to be proposed by her to the bill S. 754, to improve cybersecurity in
the United States through enhanced sharing of information about
cybersecurity threats, and for other purposes; which was ordered to lie
on the table; as follows:
At the end, add the following:
TITLE II--FEDERAL INFORMATION SECURITY MANAGEMENT REFORM ACT OF 2015
SEC. 201. SHORT TITLE.
This title may be cited as the ``Federal Information
Security Management Reform Act of 2015''.
SEC. 202. DUTIES OF THE SECRETARY OF HOMELAND SECURITY
RELATED TO INFORMATION SECURITY.
Section 3553(b)(6) of title 44, United States Code, is
amended by striking subparagraphs (B), (C), and (D) and
inserting the following:
``(B) operating consolidated intrusion detection,
prevention, or other protective capabilities and use of
associated countermeasures for the purpose of protecting
agency information and information systems from information
security threats;
``(C) providing incident detection, analysis, mitigation,
and response information and remote or onsite technical
assistance to the head of an agency;
``(D) compiling and analyzing data on agency information
security;
``(E) developing and conducting targeted risk assessments
and operational evaluations for agency information and
information systems in consultation with the heads of other
agencies or governmental and private entities that own and
operate such systems, that may include threat, vulnerability,
and impact assessments;
``(F) in conjunction with other agencies and the private
sector, assessing and fostering the development of
information security technologies and capabilities for use
across multiple agencies; and
``(G) coordinating with appropriate agencies and officials
to ensure, to the maximum extent feasible, that policies and
directives issued under paragraph (2) are complementary
with--
``(i) standards and guidelines developed for national
security systems; and
``(ii) policies and directives issued by the Secretary of
Defense and the Director of National Intelligence under
subsection (e)(1); and''.
SEC. 203. COMMUNICATIONS AND SYSTEM TRAFFIC AND DIRECTION TO
AGENCIES.
Section 3553 of title 44, United States Code, is amended by
adding at the end the following:
``(h) Communications and Systems Traffic.--
``(1) In general.--
``(A) Acquisition by the secretary.--Notwithstanding any
other provision of law and subject to subparagraph (B), in
carrying out the responsibilities under subparagraphs (B),
(C), and (E) of subsection (b)(6), if the Secretary makes a
certification described in paragraph (2), the Secretary may
acquire, intercept, retain, use, and disclose communications
and other system traffic that are transiting to or from or
stored on agency information systems and deploy
countermeasures with regard to the communications and system
traffic.
``(B) Exception.--The authorities of the Secretary under
this subsection shall not
[[Page S6244]]
apply to a communication or other system traffic that is
transiting to or from or stored on a system described in
paragraph (2) or (3) of subsection (e).
``(C) Disclosure by federal agency heads.--The head of a
Federal agency or department is authorized to disclose to the
Secretary or a private entity providing assistance to the
Secretary under paragraph (A), information traveling to or
from or stored on an agency information system,
notwithstanding any other law that would otherwise restrict
or prevent agency heads from disclosing such information to
the Secretary.
``(2) Certification.--A certification described in this
paragraph is a certification by the Secretary that--
``(A) the acquisitions, interceptions, and other
countermeasures are reasonably necessary for the purpose of
protecting agency information systems from information
security threats;
``(B) the content of communications will be retained only
if the communication is associated with a known or reasonably
suspected information security threat, and communications and
system traffic will not be subject to the operation of a
countermeasure unless associated with the threats;
``(C) information obtained under activities authorized
under this subsection will only be retained, used, or
disclosed to protect agency information systems from
information security threats, mitigate against such threats,
or, with the approval of the Attorney General, for law
enforcement purposes when the information is evidence of a
crime which has been, is being, or is about to be committed;
``(D) notice has been provided to users of agency
information systems concerning the potential for acquisition,
interception, retention, use, and disclosure of
communications and other system traffic; and
``(E) the activities are implemented pursuant to policies
and procedures governing the acquisition, interception,
retention, use, and disclosure of communications and other
system traffic that have been reviewed and approved by the
Attorney General.
``(3) Private entities.--The Secretary may enter into
contracts or other agreements, or otherwise request and
obtain the assistance of, private entities that provide
electronic communication or information security services to
acquire, intercept, retain, use, and disclose communications
and other system traffic in accordance with this subsection.
``(4) No cause of action.--No cause of action shall exist
against a private entity for assistance provided to the
Secretary in accordance with paragraph (3).
``(i) Direction to Agencies.--
``(1) Authority.--
``(A) In general.--Notwithstanding section 3554, and
subject to subparagraph (B), in response to a known or
reasonably suspected information security threat,
vulnerability, or incident that represents a substantial
threat to the information security of an agency, the
Secretary may issue a directive to the head of an agency to
take any lawful action with respect to the operation of the
information system, including such systems owned or operated
by another entity on behalf of an agency, that collects,
processes, stores, transmits, disseminates, or otherwise
maintains agency information, for the purpose of protecting
the information system from, or mitigating, an information
security threat.
``(B) Exception.--The authorities of the Secretary under
this subsection shall not apply to a system described in
paragraph (2) or (3) of subsection (e).
``(2) Procedures for use of authority.--The Secretary
shall--
``(A) in coordination with the Director and in consultation
with Federal contractors, as appropriate, establish
procedures governing the circumstances under which a
directive may be issued under this subsection, which shall
include--
``(i) thresholds and other criteria;
``(ii) privacy and civil liberties protections; and
``(iii) providing notice to potentially affected third
parties;
``(B) specify the reasons for the required action and the
duration of the directive;
``(C) minimize the impact of a directive under this
subsection by--
``(i) adopting the least intrusive means possible under the
circumstances to secure the agency information systems; and
``(ii) limiting directives to the shortest period
practicable; and
``(D) notify the Director and the head of any affected
agency immediately upon the issuance of a directive under
this subsection.
``(3) Imminent threats.--
``(A) In general.--If the Secretary determines that there
is an imminent threat to agency information systems and a
directive under this subsection is not reasonably likely to
result in a timely response to the threat, the Secretary may
authorize the use of protective capabilities under the
control of the Secretary for communications or other system
traffic transiting to or from or stored on an agency
information system without prior consultation with the
affected agency for the purpose of ensuring the security of
the information or information system or other agency
information systems.
``(B) Limitation on delegation.--The authority under this
paragraph may not be delegated to an official in a position
lower than an Assistant Secretary of the Department of
Homeland Security.
``(C) Notice.--The Secretary shall immediately notify the
Director and the head and chief information officer (or
equivalent official) of each affected agency of--
``(i) any action taken under this subsection; and
``(ii) the reasons for and duration and nature of the
action.
``(D) Other law.--Any action of the Secretary under this
paragraph shall be consistent with applicable law.
``(4) Limitation.--The Secretary may direct or authorize
lawful action or protective capability under this subsection
only to--
``(A) protect agency information from unauthorized access,
use, disclosure, disruption, modification, or destruction; or
``(B) require the remediation of or protect against
identified information security risks with respect to--
``(i) information collected or maintained by or on behalf
of an agency; or
``(ii) that portion of an information system used or
operated by an agency or by a contractor of an agency or
other organization on behalf of an agency.''.
SEC. 204. REPORT TO CONGRESS REGARDING OFFICE OF MANAGEMENT
AND BUDGET ENFORCEMENT ACTION.
Section 3553 of title 44, United States Code, as amended by
section 203, is further amended by inserting at the end the
following new subsection:
``(j) Annual Report to Congress.--
``(1) Requirement.--Not later than February 1 of every
year, the Director shall report to the appropriate
congressional committee regarding the specific actions the
Director has taken pursuant to subsection (a)(5), including
any actions taken pursuant to paragraph (5) of title 40 of
section 11303(b).
``(2) Appropriate congressional committee.--In this
subsection, the term `appropriate congressional committee'
means--
``(A) the Committee on Appropriations and the Committee on
Homeland Security and Governmental Affairs of the Senate; and
``(B) the Committee on Appropriations and the Committee on
Homeland Security of the House of Representatives.''.
______