[Congressional Record Volume 161, Number 154 (Wednesday, October 21, 2015)]
[Senate]
[Pages S7419-S7422]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
SA 2745. Mr. FRANKEN (for himself and Mr. Leahy) submitted an
amendment intended to be proposed to amendment SA 2716 proposed by Mr.
Burr (for himself and Mrs. Feinstein) to the bill S. 754, to improve
cybersecurity in the United States through enhanced sharing of
information about cybersecurity threats, and for other purposes; which
was ordered to lie on the table; as follows:
Beginning on page 14, strike line 4 and all that follows
through page 39, line 21, and insert the following:
(b) Authorization for Operation of Defensive Measures.--
(1) In general.--Notwithstanding any other provision of
law, a private entity may, for cybersecurity purposes,
operate a defensive measure that is applied to--
(A) an information system of such private entity in order
to protect the rights or property of the private entity;
(B) an information system of another entity upon written
consent of such entity for operation of such defensive
measure to protect the rights or property of such entity; and
(C) an information system of a Federal entity upon written
consent of an authorized representative of such Federal
entity for operation of such defensive measure to protect the
rights or property of the Federal Government.
(2) Construction.--Nothing in this subsection shall be
construed--
(A) to authorize the use of a defensive measure other than
as provided in this subsection; or
(B) to limit otherwise lawful activity.
(c) Authorization for Sharing or Receiving Cyber Threat
Indicators or Defensive Measures.--
(1) In general.--Except as provided in paragraph (2) and
notwithstanding any other provision of law, an entity may,
for a cybersecurity purpose and consistent with the
protection of classified information, share with, or receive
from, any other entity or the Federal Government a cyber
threat indicator or defensive measure.
[[Page S7420]]
(2) Lawful restriction.--An entity receiving a cyber threat
indicator or defensive measure from another entity or Federal
entity shall comply with otherwise lawful restrictions placed
on the sharing or use of such cyber threat indicator or
defensive measure by the sharing entity or Federal entity.
(3) Construction.--Nothing in this subsection shall be
construed--
(A) to authorize the sharing or receiving of a cyber threat
indicator or defensive measure other than as provided in this
subsection; or
(B) to limit otherwise lawful activity.
(d) Protection and Use of Information.--
(1) Security of information.--An entity operating a
defensive measure or providing or receiving a cyber threat
indicator or defensive measure under this section shall
implement and utilize a security control to protect against
unauthorized access to or acquisition of such cyber threat
indicator or defensive measure.
(2) Removal of certain personal information.--An entity
sharing a cyber threat indicator pursuant to this title
shall, prior to such sharing--
(A) review such cyber threat indicator to assess whether
such cyber threat indicator contains any information that the
entity knows at the time of sharing to be personal
information or information that identifies a specific person
not directly related to a cybersecurity threat and remove
such information; or
(B) implement and utilize a technical capability configured
to remove any information contained within such indicator
that the entity knows at the time of sharing to be personal
information or information that identifies a specific person
not directly related to a cybersecurity threat.
(3) Use of cyber threat indicators and defensive measures
by entities.--
(A) In general.--Consistent with this title, a cyber threat
indicator or defensive measure shared or received under this
section may, for cybersecurity purposes--
(i) be used by an entity to operate a defensive measure
that is applied to--
(I) an information system of the entity; or
(II) an information system of another entity or a Federal
entity upon the written consent of that other entity or that
Federal entity; and
(ii) be otherwise used, retained, and further shared by an
entity subject to--
(I) an otherwise lawful restriction placed by the sharing
entity or Federal entity on such cyber threat indicator or
defensive measure; or
(II) an otherwise applicable provision of law.
(B) Construction.--Nothing in this paragraph shall be
construed to authorize the use of a cyber threat indicator or
defensive measure other than as provided in this section.
(4) Use of cyber threat indicators by state, tribal, or
local government.--
(A) Law enforcement use.--
(i) Prior written consent.--Except as provided in clause
(ii), a cyber threat indicator shared with a State, tribal,
or local government under this section may, with the prior
written consent of the entity sharing such indicator, be used
by a State, tribal, or local government for the purpose of
preventing, investigating, or prosecuting any of the offenses
described in section 105(d)(5)(A)(vi).
(ii) Oral consent.--If exigent circumstances prevent
obtaining written consent under clause (i), such consent may
be provided orally with subsequent documentation of the
consent.
(B) Exemption from disclosure.--A cyber threat indicator
shared with a State, tribal, or local government under this
section shall be--
(i) deemed voluntarily shared information; and
(ii) exempt from disclosure under any State, tribal, or
local law requiring disclosure of information or records.
(C) State, tribal, and local regulatory authority.--
(i) In general.--Except as provided in clause (ii), a cyber
threat indicator or defensive measure shared with a State,
tribal, or local government under this title shall not be
directly used by any State, tribal, or local government to
regulate, including an enforcement action, the lawful
activity of any entity, including an activity relating to
operating a defensive measure or sharing of a cyber threat
indicator.
(ii) Regulatory authority specifically relating to
prevention or mitigation of cybersecurity threats.--A cyber
threat indicator or defensive measures shared as described in
clause (i) may, consistent with a State, tribal, or local
government regulatory authority specifically relating to the
prevention or mitigation of cybersecurity threats to
information systems, inform the development or implementation
of a regulation relating to such information systems.
(e) Antitrust Exemption.--
(1) In general.--Except as provided in section 108(e), it
shall not be considered a violation of any provision of
antitrust laws for 2 or more private entities to exchange or
provide a cyber threat indicator, or assistance relating to
the prevention, investigation, or mitigation of a
cybersecurity threat, for cybersecurity purposes under this
title.
(2) Applicability.--Paragraph (1) shall apply only to
information that is exchanged or assistance provided in order
to assist with--
(A) facilitating the prevention, investigation, or
mitigation of a cybersecurity threat to an information system
or information that is stored on, processed by, or transiting
an information system; or
(B) communicating or disclosing a cyber threat indicator to
help prevent, investigate, or mitigate the effect of a
cybersecurity threat to an information system or information
that is stored on, processed by, or transiting an information
system.
(f) No Right or Benefit.--The sharing of a cyber threat
indicator with an entity under this title shall not create a
right or benefit to similar information by such entity or any
other entity.
SEC. 105. SHARING OF CYBER THREAT INDICATORS AND DEFENSIVE
MEASURES WITH THE FEDERAL GOVERNMENT.
(a) Requirement for Policies and Procedures.--
(1) Interim policies and procedures.--Not later than 60
days after the date of the enactment of this Act, the
Attorney General and the Secretary of Homeland Security
shall, in coordination with the heads of the appropriate
Federal entities, develop and submit to Congress interim
policies and procedures relating to the receipt of cyber
threat indicators and defensive measures by the Federal
Government.
(2) Final policies and procedures.--Not later than 180 days
after the date of the enactment of this Act, the Attorney
General and the Secretary of Homeland Security shall, in
coordination with the heads of the appropriate Federal
entities, promulgate final policies and procedures relating
to the receipt of cyber threat indicators and defensive
measures by the Federal Government.
(3) Requirements concerning policies and procedures.--
Consistent with the guidelines required by subsection (b),
the policies and procedures developed and promulgated under
this subsection shall--
(A) ensure that cyber threat indicators shared with the
Federal Government by any entity pursuant to section 104(c)
through the real-time process described in subsection (c) of
this section--
(i) are shared in an automated manner with all of the
appropriate Federal entities;
(ii) are only subject to a delay, modification, or other
action due to controls established for such real-time process
that could impede real-time receipt by all of the appropriate
Federal entities when the delay, modification, or other
action is due to controls--
(I) agreed upon unanimously by all of the heads of the
appropriate Federal entities;
(II) carried out before any of the appropriate Federal
entities retains or uses the cyber threat indicators or
defensive measures; and
(III) uniformly applied such that each of the appropriate
Federal entities is subject to the same delay, modification,
or other action; and
(iii) may be provided to other Federal entities;
(B) ensure that cyber threat indicators shared with the
Federal Government by any entity pursuant to section 104 in a
manner other than the real time process described in
subsection (c) of this section--
(i) are shared as quickly as operationally practicable with
all of the appropriate Federal entities;
(ii) are not subject to any unnecessary delay,
interference, or any other action that could impede receipt
by all of the appropriate Federal entities; and
(iii) may be provided to other Federal entities;
(C) consistent with this title, any other applicable
provisions of law, and the fair information practice
principles set forth in appendix A of the document entitled
``National Strategy for Trusted Identities in Cyberspace''
and published by the President in April, 2011, govern the
retention, use, and dissemination by the Federal Government
of cyber threat indicators shared with the Federal Government
under this title, including the extent, if any, to which such
cyber threat indicators may be used by the Federal
Government; and
(D) ensure there are--
(i) audit capabilities; and
(ii) appropriate sanctions in place for officers,
employees, or agents of a Federal entity who knowingly and
willfully conduct activities under this title in an
unauthorized manner.
(4) Guidelines for entities sharing cyber threat indicators
with federal government.--
(A) In general.--Not later than 60 days after the date of
the enactment of this Act, the Attorney General and the
Secretary of Homeland Security shall develop and make
publicly available guidance to assist entities and promote
sharing of cyber threat indicators with Federal entities
under this title.
(B) Contents.--The guidelines developed and made publicly
available under subparagraph (A) shall include guidance on
the following:
(i) Identification of types of information that would
qualify as a cyber threat indicator under this title that
would be unlikely to include personal information or
information that identifies a specific person not directly
related to a cyber security threat.
(ii) Identification of types of information protected under
otherwise applicable privacy laws that are unlikely to be
directly related to a cybersecurity threat.
(iii) Such other matters as the Attorney General and the
Secretary of Homeland Security consider appropriate for
entities sharing cyber threat indicators with Federal
entities under this title.
[[Page S7421]]
(b) Privacy and Civil Liberties.--
(1) Guidelines of attorney general.--Not later than 60 days
after the date of the enactment of this Act, the Attorney
General shall, in coordination with heads of the appropriate
Federal entities and in consultation with officers designated
under section 1062 of the National Security Intelligence
Reform Act of 2004 (42 U.S.C. 2000ee-1), develop, submit to
Congress, and make available to the public interim guidelines
relating to privacy and civil liberties which shall govern
the receipt, retention, use, and dissemination of cyber
threat indicators by a Federal entity obtained in connection
with activities authorized in this title.
(2) Final guidelines.--
(A) In general.--Not later than 180 days after the date of
the enactment of this Act, the Attorney General shall, in
coordination with heads of the appropriate Federal entities
and in consultation with officers designated under section
1062 of the National Security Intelligence Reform Act of 2004
(42 U.S.C. 2000ee-1) and such private entities with industry
expertise as the Attorney General considers relevant,
promulgate final guidelines relating to privacy and civil
liberties which shall govern the receipt, retention, use, and
dissemination of cyber threat indicators by a Federal entity
obtained in connection with activities authorized in this
title.
(B) Periodic review.--The Attorney General shall, in
coordination with heads of the appropriate Federal entities
and in consultation with officers and private entities
described in subparagraph (A), periodically, but not less
frequently than once every two years, review the guidelines
promulgated under subparagraph (A).
(3) Content.--The guidelines required by paragraphs (1) and
(2) shall, consistent with the need to protect information
systems from cybersecurity threats and mitigate cybersecurity
threats--
(A) limit the effect on privacy and civil liberties of
activities by the Federal Government under this title;
(B) limit the receipt, retention, use, and dissemination of
cyber threat indicators containing personal information or
information that identifies specific persons, including by
establishing--
(i) a process for the timely destruction of such
information that is known not to be directly related to uses
authorized under this title; and
(ii) specific limitations on the length of any period in
which a cyber threat indicator may be retained;
(C) include requirements to safeguard cyber threat
indicators containing personal information or information
that identifies specific persons from unauthorized access or
acquisition, including appropriate sanctions for activities
by officers, employees, or agents of the Federal Government
in contravention of such guidelines;
(D) include procedures for notifying entities and Federal
entities if information received pursuant to this section is
known or determined by a Federal entity receiving such
information not to constitute a cyber threat indicator;
(E) protect the confidentiality of cyber threat indicators
containing personal information or information that
identifies specific persons to the greatest extent
practicable and require recipients to be informed that such
indicators may only be used for purposes authorized under
this title; and
(F) include steps that may be needed so that dissemination
of cyber threat indicators is consistent with the protection
of classified and other sensitive national security
information.
(c) Capability and Process Within the Department of
Homeland Security.--
(1) In general.--Not later than 90 days after the date of
the enactment of this Act, the Secretary of Homeland
Security, in coordination with the heads of the appropriate
Federal entities, shall develop and implement a capability
and process within the Department of Homeland Security that--
(A) shall accept from any entity in real time cyber threat
indicators and defensive measures, pursuant to this section;
(B) shall, upon submittal of the certification under
paragraph (2) that such capability and process fully and
effectively operates as described in such paragraph, be the
process by which the Federal Government receives cyber threat
indicators and defensive measures under this title that are
shared by a private entity with the Federal Government
through electronic mail or media, an interactive form on an
Internet website, or a real time, automated process between
information systems except--
(i) consistent with section 104, communications between a
Federal entity and a private entity regarding a previously
shared cyber threat indicator to describe the relevant
cybersecurity threat or develop a defensive measure based on
such cyber threat indicator; and
(ii) communications by a regulated entity with such
entity's Federal regulatory authority regarding a
cybersecurity threat;
(C) ensures that all of the appropriate Federal entities
receive in an automated manner such cyber threat indicators
shared through the real-time process within the Department of
Homeland Security;
(D) is in compliance with the policies, procedures, and
guidelines required by this section; and
(E) does not limit or prohibit otherwise lawful disclosures
of communications, records, or other information, including--
(i) reporting of known or suspected criminal activity, by
an entity to any other entity or a Federal entity;
(ii) voluntary or legally compelled participation in a
Federal investigation; and
(iii) providing cyber threat indicators or defensive
measures as part of a statutory or authorized contractual
requirement.
(2) Certification.--Not later than 10 days prior to the
implementation of the capability and process required by
paragraph (1), the Secretary of Homeland Security shall, in
consultation with the heads of the appropriate Federal
entities, certify to Congress whether such capability and
process fully and effectively operates--
(A) as the process by which the Federal Government receives
from any entity a cyber threat indicator or defensive measure
under this title; and
(B) in accordance with the policies, procedures, and
guidelines developed under this section.
(3) Public notice and access.--The Secretary of Homeland
Security shall ensure there is public notice of, and access
to, the capability and process developed and implemented
under paragraph (1) so that--
(A) any entity may share cyber threat indicators and
defensive measures through such process with the Federal
Government; and
(B) all of the appropriate Federal entities receive such
cyber threat indicators and defensive measures in real time
with receipt through the process within the Department of
Homeland Security.
(4) Other federal entities.--The process developed and
implemented under paragraph (1) shall ensure that other
Federal entities receive in a timely manner any cyber threat
indicators and defensive measures shared with the Federal
Government through such process.
(5) Report on development and implementation.--
(A) In general.--Not later than 60 days after the date of
the enactment of this Act, the Secretary of Homeland Security
shall submit to Congress a report on the development and
implementation of the capability and process required by
paragraph (1), including a description of such capability and
process and the public notice of, and access to, such
process.
(B) Classified annex.--The report required by subparagraph
(A) shall be submitted in unclassified form, but may include
a classified annex.
(d) Information Shared With or Provided to the Federal
Government.--
(1) No waiver of privilege or protection.--The provision of
cyber threat indicators and defensive measures to the Federal
Government under this title shall not constitute a waiver of
any applicable privilege or protection provided by law,
including trade secret protection.
(2) Proprietary information.--Consistent with section
104(c)(2), a cyber threat indicator or defensive measure
provided by an entity to the Federal Government under this
title shall be considered the commercial, financial, and
proprietary information of such entity when so designated by
the originating entity or a third party acting in accordance
with the written authorization of the originating entity.
(3) Exemption from disclosure.--Cyber threat indicators and
defensive measures provided to the Federal Government under
this title shall be--
(A) deemed voluntarily shared information and exempt from
disclosure under section 552 of title 5, United States Code,
and any State, tribal, or local law requiring disclosure of
information or records; and
(B) withheld, without discretion, from the public under
section 552(b)(3)(B) of title 5, United States Code, and any
State, tribal, or local provision of law requiring disclosure
of information or records.
(4) Ex parte communications.--The provision of a cyber
threat indicator or defensive measure to the Federal
Government under this title shall not be subject to a rule of
any Federal agency or department or any judicial doctrine
regarding ex parte communications with a decision-making
official.
(5) Disclosure, retention, and use.--
(A) Authorized activities.--Cyber threat indicators and
defensive measures provided to the Federal Government under
this title may be disclosed to, retained by, and used by,
consistent with otherwise applicable provisions of Federal
law, any Federal agency or department, component, officer,
employee, or agent of the Federal Government solely for--
(i) a cybersecurity purpose;
(ii) the purpose of identifying a cybersecurity threat,
including the source of such cybersecurity threat, or a
security vulnerability;
(iii) the purpose of identifying a cybersecurity threat
involving the use of an information system by a foreign
adversary or terrorist;
(iv) the purpose of responding to, or otherwise preventing
or mitigating, an imminent threat of death, serious bodily
harm, or serious economic harm, including a terrorist act or
a use of a weapon of mass destruction;
(v) the purpose of responding to, or otherwise preventing
or mitigating, a serious threat to a minor, including sexual
exploitation and threats to physical safety; or
[[Page S7422]]
(vi) the purpose of preventing, investigating, disrupting,
or prosecuting an offense arising out of a threat described
in clause (iv) or any of the offenses listed in--
(I) sections 1028 through 1030 of title 18, United States
Code (relating to fraud and identity theft);
(II) chapter 37 of such title (relating to espionage and
censorship); and
(III) chapter 90 of such title (relating to protection of
trade secrets).
(B) Prohibited activities.--Cyber threat indicators and
defensive measures provided to the Federal Government under
this title shall not be disclosed to, retained by, or used by
any Federal agency or department for any use not permitted
under subparagraph (A).
(C) Privacy and civil liberties.--Cyber threat indicators
and defensive measures provided to the Federal Government
under this title shall be retained, used, and disseminated by
the Federal Government--
(i) in accordance with the policies, procedures, and
guidelines required by subsections (a) and (b);
(ii) in a manner that protects from unauthorized use or
disclosure any cyber threat indicators that may contain
personal information or information that identifies specific
persons; and
(iii) in a manner that protects the confidentiality of
cyber threat indicators containing personal information or
information that identifies a specific person.
(D) Federal regulatory authority.--
(i) In general.--Except as provided in clause (ii), cyber
threat indicators and defensive measures provided to the
Federal Government under this title shall not be directly
used by any Federal, State, tribal, or local government to
regulate, including an enforcement action, the lawful
activities of any entity, including activities relating to
operating defensive measures or sharing cyber threat
indicators.
(ii) Exceptions.--
(I) Regulatory authority specifically relating to
prevention or mitigation of cybersecurity threats.--Cyber
threat indicators and defensive measures provided to the
Federal Government under this title may, consistent with
Federal or State regulatory authority specifically relating
to the prevention or mitigation of cybersecurity threats to
information systems, inform the development or implementation
of regulations relating to such information systems.
(II) Procedures developed and implemented under this
title.--Clause (i) shall not apply to procedures developed
and implemented under this title.
SEC. 106. PROTECTION FROM LIABILITY.
______