    [United States Statutes at Large, Volume 132, 115th Congress, 2nd Session]
    [From the U.S. Government Publishing Office, www.gpo.gov]

    Public Law 115-331
    115th Congress

    An Act

    To direct the Secretary of Homeland Security to establish a data
    framework to provide access for appropriate personnel to law enforcement
    and other information of the Department, and for other
    purposes. <>

    Be it enacted by the Senate and House of Representatives of the
    United States of America in Congress assembled, <>
    SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Department of Homeland Security Data
    Framework Act of 2018''.
    SEC. 2. <>  DEPARTMENT OF HOMELAND SECURITY DATA
    FRAMEWORK.

    (a) In General.--
    (1) Development.--The Secretary of Homeland Security shall
    develop a data framework to integrate existing Department of
    Homeland Security datasets and systems, as appropriate, for
    access by authorized personnel in a manner consistent with
    relevant legal authorities and privacy, civil rights, and civil
    liberties policies and protections.
    (2) Requirements.--In developing the framework required
    under paragraph (1), the Secretary of Homeland Security shall
    ensure, in accordance with all applicable statutory and
    regulatory requirements, the following information is included:
    (A) All information acquired, held, or obtained by
    an office or component of the Department of Homeland
    Security that falls within the scope of the information
    sharing environment, including homeland security
    information, terrorism information, weapons of mass
    destruction information, and national intelligence.
    (B) Any information or intelligence relevant to
    priority mission needs and capability requirements of
    the homeland security enterprise, as determined
    appropriate by the Secretary.

    (b) Data Framework Access.--
    (1) <>  In general.--The Secretary of
    Homeland Security shall ensure that the data framework required
    under this section is accessible to employees of the Department
    of Homeland Security who the Secretary determines--
    (A) have an appropriate security clearance;
    (B) are assigned to perform a function that requires
    access to information in such framework; and
    (C) are trained in applicable standards for
    safeguarding and using such information.
    (2) Guidance.--The Secretary of Homeland Security shall--

    [[Page 4485]]

    (A) issue guidance for Department of Homeland
    Security employees authorized to access and contribute
    to the data framework pursuant to paragraph (1); and
    (B) ensure that such guidance enforces a duty to
    share between offices and components of the Department
    when accessing or contributing to such framework for
    mission needs.
    (3) <>  Efficiency.--The Secretary of
    Homeland Security shall promulgate data standards and instruct
    components of the Department of Homeland Security to make
    available information through the data framework required under
    this section in a machine-readable standard format, to the
    greatest extent practicable.

    (c) <>  Exclusion of Information.--The
    Secretary of Homeland Security may exclude information from the data
    framework required under this section if the Secretary determines
    inclusion of such information may--
    (1) jeopardize the protection of sources, methods, or
    activities;
    (2) compromise a criminal or national security
    investigation;
    (3) be inconsistent with other Federal laws or regulations;
    or
    (4) be duplicative or not serve an operational purpose if
    included in such framework.

    (d) Safeguards.--The Secretary of Homeland Security shall
    incorporate into the data framework required under this section systems
    capabilities for auditing and ensuring the security of information
    included in such framework. Such capabilities shall include the
    following:
    (1) Mechanisms for identifying insider threats.
    (2) Mechanisms for identifying security risks.
    (3) Safeguards for privacy, civil rights, and civil
    liberties.

    (e) Deadline for Implementation.--Not later than 2 years after the
    date of enactment of this Act, the Secretary of Homeland Security shall
    ensure the data framework required under this section has the ability to
    include appropriate information in existence within the Department of
    Homeland Security to meet the critical mission operations of the
    Department of Homeland Security.
    (f) Notice to Congress.--
    (1) Status updates.--The Secretary of Homeland Security
    shall submit to the appropriate congressional committees regular
    updates on the status of the data framework until the framework
    is fully operational.
    (2) <>  Operational notification.--Not
    later than 60 days after the date on which the data framework
    required under this section is fully operational, the Secretary
    of Homeland Security shall provide notice to the appropriate
    congressional committees that the data framework is fully
    operational.
    (3) <>  Value added.--The Secretary of
    Homeland Security shall annually brief Congress on component use
    of the data framework required under this section to support
    operations that disrupt terrorist activities and incidents in
    the homeland.

    (g) Definitions.--In this section:

    [[Page 4486]]

    (1) Appropriate congressional committee; homeland.--The
    terms ``appropriate congressional committee'' and ``homeland''
    have the meaning given those terms in section 2 of the Homeland
    Security Act of 2002 (6 U.S.C. 101).
    (2) Homeland security information.--The term ``homeland
    security information'' has the meaning given such term in
    section 892 of the Homeland Security Act of 2002 (6 U.S.C. 482).
    (3) National intelligence.--The term ``national
    intelligence'' has the meaning given such term in section 3(5)
    of the National Security Act of 1947 (50 U.S.C. 3003(5)).
    (4) Terrorism information.--The term ``terrorism
    information'' has the meaning given such term in section 1016 of
    the Intelligence Reform and Terrorism Prevention Act of 2004 (6
    U.S.C. 485).

    Approved December 19, 2018.

    LEGISLATIVE HISTORY--H.R. 2454 (S. 2397):
    ---------------------------------------------------------------------------

    SENATE REPORTS: No. 115-380 (Comm. on Homeland Security and Governmental
    Affairs) accompanying S. 2397.
    CONGRESSIONAL RECORD:
    Vol. 163 (2017):
    Sept. 12, considered and passed
    House.
    Vol. 164 (2018):
    Dec. 6, considered and passed
    Senate, amended.
    Dec. 12, House concurred in Senate
    amendment.