2018—Pub. L. 115–232, div. A, title XVI, §1631(c)(2), Aug. 13, 2018, 132 Stat. 2123, added items 394 to 396.
2015—Pub. L. 114–92, div. A, title X, §1081(a)(4), title XVI, §1641(c)(2), Nov. 25, 2015, 129 Stat. 1001, 1116, substituted "Reporting on cyber incidents with respect to networks and information systems of operationally critical contractors and certain other contractors" for "Reporting on cyber incidents with respect to networks and information systems of operationally critical contractors" in item 391 and added item 393.
2014—Pub. L. 113–291, div. A, title XVI, §1633(d), Dec. 19, 2014, 128 Stat. 3643, added item 392.
(a)
(b)
(c)
(1)
(A) designating operationally critical contractors; and
(B) notifying a contractor that it has been designated as an operationally critical contractor.
(2)
(A) An assessment by the contractor of the effect of the cyber incident on the ability of the contractor to meet the contractual requirements of the Department.
(B) The technique or method used in such cyber incident.
(C) A sample of any malicious software, if discovered and isolated by the contractor, involved in such cyber incident.
(D) A summary of information compromised by such cyber incident.
(3)
(A) include mechanisms for Department personnel to, if requested, assist operationally critical contractors in detecting and mitigating penetrations; and
(B) provide that an operationally critical contractor is only required to provide access to equipment or information as described in subparagraph (A) to determine whether information created by or for the Department in connection with any Department program was successfully exfiltrated from a network or information system of such contractor and, if so, what information was exfiltrated.
(4)
(5)
(A) with missions that may be affected by such information;
(B) that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;
(C) that conduct counterintelligence or law enforcement investigations; or
(D) for national security purposes, including cyber situational awareness and defense purposes.
(d)
(2)(A) Nothing in this section shall be construed—
(i) to require dismissal of a cause of action against an operationally critical contractor that has engaged in willful misconduct in the course of complying with the procedures established pursuant to subsection (b); or
(ii) to undermine or limit the availability of otherwise applicable common law or statutory defenses.
(B) In any action claiming that paragraph (1) does not apply due to willful misconduct described in subparagraph (A), the plaintiff shall have the burden of proving by clear and convincing evidence the willful misconduct by each operationally critical contractor subject to such claim and that such willful misconduct proximately caused injury to the plaintiff.
(C) In this subsection, the term "willful misconduct" means an act or omission that is taken—
(i) intentionally to achieve a wrongful purpose;
(ii) knowingly without legal or factual justification; and
(iii) in disregard of a known or obvious risk that is so great as to make it highly probable that the harm will outweigh the benefit.
(e)
(1)
(2)
(Added Pub. L. 113–291, div. A, title XVI, §1632(a), Dec. 19, 2014, 128 Stat. 3639; amended Pub. L. 114–92, div. A, title XVI, §1641(b), (c)(1), Nov. 25, 2015, 129 Stat. 1115, 1116.)
2015—Subsec. (a). Pub. L. 114–92, §1641(c)(1), substituted "and section 393 of this title" for "and with section 941 of the National Defense Authorization Act for Fiscal Year 2013 (10 U.S.C. 2224 note)".
Subsecs. (d), (e). Pub. L. 114–92, §1641(b), added subsec. (d) and redesignated former subsec. (d) as (e).
Pub. L. 113–291, div. A, title XVI, §1632(b), Dec. 19, 2014, 128 Stat. 3640, provided that: "The Secretary shall establish the procedures required by subsection (b) of section 391 of title 10, United States Code, as added by subsection (a) of this section, not later than 90 days after the date of the enactment of this Act [Dec. 19, 2014]."
Pub. L. 113–291, div. A, title XVI, §1632(c), Dec. 19, 2014, 128 Stat. 3640, provided that:
"(1)
"(A) requirements that were in effect on the day before the date of the enactment of this Act for contractors to share information with Department components regarding cyber incidents (as defined in subsection (d) [now (e)] of such section 391 [10 U.S.C. 391(e)]) with respect to networks or information systems of contractors; and
"(B) Department policies and systems for sharing information on cyber incidents with respect to networks or information systems of Department contractors.
"(2)
"(A) designate a Department component under subsection (a) of such section 391; and
"(B) issue or revise guidance applicable to Department components that ensures the rapid sharing by the component designated pursuant to such section 391 or section 941 of the National Defense Authorization Act for Fiscal Year 2013 [Pub. L. 112–239] (10 U.S.C. 2224 note) of information relating to cyber incidents with respect to networks or information systems of contractors with other appropriate Department components."
(a)
(1) designate a senior official from among the personnel of the Department of Defense to act as the executive agent for cyber and information technology test ranges; and
(2) designate a senior official from among the personnel of the Department of Defense to act as the executive agent for cyber and information technology training ranges.
(b)
(1)
(2)
(A) Developing and maintaining a comprehensive list of cyber and information technology ranges, test facilities, test beds, and other means of testing, training, and developing software, personnel, and tools for accommodating the mission of the Department. Such list shall include resources from both governmental and nongovernmental entities.
(B) Organizing and managing designated cyber and information technology test ranges, including—
(i) establishing the priorities for cyber and information technology ranges to meet Department objectives;
(ii) enforcing standards to meet requirements specified by the United States Cyber Command, the training community, and the research, development, testing, and evaluation community;
(iii) identifying and offering guidance on the opportunities for integration amongst the designated cyber and information technology ranges regarding test, training, and development functions;
(iv) finding opportunities for cost reduction, integration, and coordination improvements for the appropriate cyber and information technology ranges;
(v) adding or consolidating cyber and information technology ranges in the future to better meet the evolving needs of the cyber strategy and resource requirements of the Department;
(vi) finding opportunities to continuously enhance the quality and technical expertise of the cyber and information technology test workforce through training and personnel policies; and
(vii) coordinating with interagency and industry partners on cyber and information technology range issues.
(C) Defining a cyber range architecture that—
(i) may add or consolidate cyber and information technology ranges in the future to better meet the evolving needs of the cyber strategy and resource requirements of the Department;
(ii) coordinates with interagency and industry partners on cyber and information technology range issues;
(iii) allows for integrated closed loop testing in a secure environment of cyber and electronic warfare capabilities;
(iv) supports science and technology development, experimentation, testing and training; and
(v) provides for interconnection with other existing cyber ranges and other kinetic range facilities in a distributed manner.
(D) Certifying all cyber range investments of the Department of Defense.
(E) Performing such other assessments or analyses as the Secretary considers appropriate.
(3)
(c)
(d)
(e)
(1) The term "designated cyber and information technology range" includes the National Cyber Range, the Joint Information Operations Range, the Defense Information Assurance Range, and the C4 Assessments Division of J6 of the Joint Staff.
(2) The term "Directive 5101.1" means Department of Defense Directive 5101.1, or any successor directive relating to the responsibilities of an executive agent of the Department of Defense.
(3) The term "executive agent" has the meaning given the term "DoD Executive Agent" in Directive 5101.1.
(Added Pub. L. 113–291, div. A, title XVI, §1633(a), Dec. 19, 2014, 128 Stat. 3641.)
Pub. L. 113–291, div. A, title XVI, §1633(b), (c), Dec. 19, 2014, 128 Stat. 3642, provided that:
"(b)
"(1) not later than 120 days after the date of the enactment of this Act [Dec. 19, 2014], designate the executive agents required under subsection (a) of section 392 of title 10, United States Code, as added by subsection (a) of this section; and
"(2) not later than one year after the date of the enactment of this Act, prescribe the roles, responsibilities, and authorities required under subsection (b) of such section 392.
"(c)
(a)
(b)
(1)
(2)
(A) The Under Secretary of Defense for Policy.
(B) The Under Secretary of Defense for Acquisition, Technology, and Logistics.
(C) The Under Secretary of Defense for Intelligence.
(D) The Chief Information Officer of the Department of Defense.
(E) The Commander of the United States Cyber Command.
(c)
(1)
(A) A description of the technique or method used in such penetration.
(B) A sample of the malicious software, if discovered and isolated by the contractor, involved in such penetration.
(C) A summary of information created by or for the Department in connection with any Department program that has been potentially compromised due to such penetration.
(2)
(A) include mechanisms for Department of Defense personnel to, upon request, obtain access to equipment or information of a cleared defense contractor necessary to conduct forensic analysis in addition to any analysis conducted by such contractor;
(B) provide that a cleared defense contractor is only required to provide access to equipment or information as described in subparagraph (A) to determine whether information created by or for the Department in connection with any Department program was successfully exfiltrated from a network or information system of such contractor and, if so, what information was exfiltrated; and
(C) provide for the reasonable protection of trade secrets, commercial or financial information, and information that can be used to identify a specific person.
(3)
(A) with missions that may be affected by such information;
(B) that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents;
(C) that conduct counterintelligence or law enforcement investigations; or
(D) for national security purposes, including cyber situational awareness and defense purposes.
(d)
(2)(A) Nothing in this section shall be construed—
(i) to require dismissal of a cause of action against a cleared defense contractor that has engaged in willful misconduct in the course of complying with the procedures established pursuant to subsection (a); or
(ii) to undermine or limit the availability of otherwise applicable common law or statutory defenses.
(B) In any action claiming that paragraph (1) does not apply due to willful misconduct described in subparagraph (A), the plaintiff shall have the burden of proving by clear and convincing evidence the willful misconduct by each cleared defense contractor subject to such claim and that such willful misconduct proximately caused injury to the plaintiff.
(C) In this subsection, the term "willful misconduct" means an act or omission that is taken—
(i) intentionally to achieve a wrongful purpose;
(ii) knowingly without legal or factual justification; and
(iii) in disregard of a known or obvious risk that is so great as to make it highly probable that the harm will outweigh the benefit.
(e)
(1)
(2)
(Added and amended Pub. L. 114–92, div. A, title XVI, §1641(a), Nov. 25, 2015, 129 Stat. 1114.)
Section, as added and amended by Pub. L. 114–92, is based on Pub. L. 112–239, div. A, title IX, §941, Jan. 2, 2013, 126 Stat. 1889, which was formerly set out as a note under section 2224 of this title before being transferred to this chapter and renumbered as this section.
2015—Pub. L. 114–92, §1641(a)(1), substituted "Reporting on penetrations of networks and information systems of certain contractors" for "Reports to Department of Defense on penetrations of networks and information systems of certain contractors" in section catchline.
Pub. L. 114–92, §1641(a), transferred section 941 of Pub. L. 112–239 to this chapter and renumbered it as this section. See Codification note above.
Subsec. (c)(3). Pub. L. 114–92, §1641(a)(2), added par. (3) and struck out former par. (3). Prior to amendment, text read as follows: "The procedures established pursuant to subsection (a) shall prohibit the dissemination outside the Department of Defense of information obtained or derived through such procedures that is not created by or for the Department except with the approval of the contractor providing such information."
Subsec. (d). Pub. L. 114–92, §1641(a)(3), added subsec. (d) and struck out former subsec. (d). Prior to amendment, text read as follows:
"(1)
"(A) the Secretary of Defense shall establish the procedures required under subsection (a); and
"(B) the senior official designated under subsection (b)(1) shall establish the criteria required under such subsection.
"(2)
(a)
(b)
(c)
(d)
(e)
(f)
(1) The term "clandestine military activity or operation in cyberspace" means a military activity or military operation carried out in cyberspace, or associated preparatory actions, authorized by the President or the Secretary that—
(A) is marked by, held in, or conducted with secrecy, where the intent is that the activity or operation will not be apparent or acknowledged publicly; and
(B) is to be carried out—
(i) as part of a military operation plan approved by the President or the Secretary in anticipation of hostilities or as directed by the President or the Secretary;
(ii) to deter, safeguard, or defend against attacks or malicious cyber activities against the United States or Department of Defense information, networks, systems, installations, facilities, or other assets; or
(iii) in support of information related capabilities.
(2) The term "foreign power" has the meaning given such term in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801).
(3) The term "United States person" has the meaning given such term in such section.
(Added Pub. L. 114–92, div. A, title XVI, §1642(a), Nov. 25, 2015, 129 Stat. 1116, §130g; renumbered §394 and amended Pub. L. 115–232, div. A, title XVI, §§1631(a), 1632, Aug. 13, 2018, 132 Stat. 2123.)
The War Powers Resolution, referred to in subsecs. (b) and (e), is Pub. L. 93–148, Nov. 7, 1973, 87 Stat. 555, which is classified generally to chapter 33 (§1541 et seq.) of Title 50, War and National Defense. For complete classification of this Resolution to the Code, see Short Title note set out under section 1541 of Title 50 and Tables.
The Authorization for Use of Military Force, referred to in subsec. (e), is Pub. L. 107–40, Sept. 18, 2001, 115 Stat. 224, which is set out as a note under section 1541 of Title 50, War and National Defense.
2018—Pub. L. 115–232, §1632, designated existing provisions as subsec. (a), inserted heading, substituted "conduct, military cyber activities or operations in cyberspace, including clandestine military activities or operations in cyberspace, to defend the United States and its allies, including in response" for "conduct, a military cyber operation in response", struck out "(as such terms are defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801))" after "foreign power", and added subsecs. (b) to (f).
Pub. L. 115–232, §1631(a), renumbered section 130g of this title as this section.
Pub. L. 115–232, div. A, title XVI, §1636, Aug. 13, 2018, 132 Stat. 2126, provided that:
"(a)
"(1) cause casualties among United States persons or persons of United States allies;
"(2) significantly disrupt the normal functioning of United States democratic society or government (including attacks against critical infrastructure that could damage systems used to provide key services to the public or government);
"(3) threaten the command and control of the Armed Forces, the freedom of maneuver of the Armed Forces, or the industrial base or other infrastructure on which the United States Armed Forces rely to defend United States interests and commitments; or
"(4) achieve an effect, whether individually or in aggregate, comparable to an armed attack or imperil a vital interest of the United States.
"(b)
"(c)
"(d)
"(e)
"(f)
"(1)
"(2)
"(A) An assessment of the current posture in cyberspace, including assessments of—
"(i) whether past responses to major cyber attacks have had the desired deterrent effect; and
"(ii) how adversaries have responded to past United States responses.
"(B) Updates on the Administration's efforts in the development of—
"(i) cost imposition strategies;
"(ii) varying levels of cyber incursion and steps taken to date to prepare for the imposition of the consequences referred to in clause (i); and
"(iii) the Cyber Deterrence Initiative.
"(C) Information relating to the Administration's plans, including specific planned actions, regulations, and legislative action required, for—
"(i) advancing technologies in attribution, inherently secure technology, and artificial intelligence society-wide;
"(ii) improving cybersecurity in and cooperation with the private sector;
"(iii) improving international cybersecurity cooperation; and
"(iv) implementing the policy referred to in paragraph (1), including any realignment of government or government responsibilities required, writ large.
"(f) [probably should be "(g)"]
"(g) [probably should be "(h)"]
"(1)
"(A) the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives];
"(B) the Permanent Select Committee on Intelligence of the House of Representatives;
"(C) the Select Committee on Intelligence of the Senate;
"(D) the Committee on Foreign Affairs, the Committee on Homeland Security, and the Committee on the Judiciary of the House of Representatives; and
"(E) the Committee on Foreign Relations, the Committee on Homeland Security and Governmental Affairs, and the Committee on the Judiciary of the Senate.
"(2)
Pub. L. 115–91, div. A, title XVI, §1633, Dec. 12, 2017, 131 Stat. 1738, provided that:
"(a)
"(1) develop a national policy for the United States relating to cyberspace, cybersecurity, and cyber warfare; and
"(2) submit to the appropriate congressional committees a report on the policy.
"(b)
"(1) Delineation of the instruments of national power available to deter or respond to cyber attacks or other malicious cyber activities by a foreign power or actor that targets United States interests.
"(2) Available or planned response options to address the full range of potential cyber attacks on United States interests that could be conducted by potential adversaries of the United States.
"(3) Available or planned denial options that prioritize the defensibility and resiliency against cyber attacks and malicious cyber activities that are carried out against infrastructure critical to the political integrity, economic security, and national security of the United States.
"(4) Available or planned cyber capabilities that may be used to impose costs on any foreign power targeting the United States or United States persons with a cyber attack or malicious cyber activity.
"(5) Development of multi-prong response options, such as—
"(A) boosting the cyber resilience of critical United States strike systems (including cyber, nuclear, and non-nuclear systems) in order to ensure the United States can credibly threaten to impose unacceptable costs in response to even the most sophisticated large-scale cyber attack;
"(B) developing offensive cyber capabilities and specific plans and strategies to put at risk targets most valued by adversaries of the United States and their key decision makers; and
"(C) enhancing attribution capabilities and developing intelligence and offensive cyber capabilities to detect, disrupt, and potentially expose malicious cyber activities.
"(c)
"(1)
"(2)
"(A) the White House Communication Agency; and
"(B) the White House Situation Support Staff.
"(d)
"(1) The term 'foreign power' has the meaning given that term in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801).
"(2) The term 'appropriate congressional committees' means—
"(A) the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives];
"(B) the Committee on Foreign Affairs, the Committee on Homeland Security, and the Committee on the Judiciary of the House of Representatives; and
"(C) the Committee on Foreign Relations, the Committee on Homeland Security and Governmental Affairs, and the Committee on the Judiciary of the Senate."
Pub. L. 115–232, div. A, title XVI, §1642, Aug. 13, 2018, 132 Stat. 2132, provided that:
"(a)
"(1)
"(2)
"(A)
"(B)
"(i)
"(ii)
"(b)
"(c)
"(1) the scope and intensity of the information operations and attacks through cyberspace by the countries specified in subsection (a)(1) against the government or people of the United States observed by the cyber mission forces of the United States Cyber Command and the National Security Agency; and
"(2) adjustments of the Department of Defense in the response directed or recommended by the Secretary with respect to such operations and attacks.
"(d)
"(1) limit the authority of the Secretary to conduct military activities or operations in cyberspace, including clandestine activities or operations in cyberspace; or
"(2) affect the War Powers Resolution (Public Law 93–148; 50 U.S.C. 1541 et seq.) or the Authorization for Use of Military Force (Public Law 107–40; 50 U.S.C. 1541 note)."
Pub. L. 115–232, div. A, title XVI, §1649, Aug. 13, 2018, 132 Stat. 2137, provided that:
"(a)
"(1)
"(2)
"(b)
"(1) The development and demonstration of risk analysis methodologies, and the application of commercial simulation and modeling capabilities, based on artificial intelligence and hyperscale cloud computing technologies, as applicable—
"(A) to assess defense critical infrastructure vulnerabilities and interdependencies to improve military resiliency;
"(B) to determine the likely effectiveness of attacks described in subsection (a)(1), and countermeasures, tactics, and tools supporting responsive military homeland defense operations;
"(C) to train personnel in incident response;
"(D) to conduct exercises and test scenarios;
"(E) to foster collaboration and learning between and among departments and agencies of the Federal Government, State and local governments, and private entities responsible for critical infrastructure; and
"(F) improve intra-agency and inter-agency coordination for consideration and approval of requests for defense support to civil authorities.
"(2) The development and demonstration of the foundations for establishing and maintaining a program of record for a shared high-fidelity, interactive, affordable, cloud-based modeling and simulation of critical infrastructure systems and incident response capabilities that can simulate complex cyber and physical attacks and disruptions on individual and multiple sectors on national, regional, State, and local scales.
"(c)
"(1)
"(2)
"(A) A description of the results of the pilot program as of the date of the report.
"(B) A description of the risk analysis methodologies and modeling and simulation capabilities developed and demonstrated pursuant to the pilot program, and an assessment of the potential for future growth of commercial technology in support of the homeland defense mission of the Department of Defense.
"(C) Such recommendations as the Secretary considers appropriate regarding the establishment of a program of record for the Department on further development and sustainment of risk analysis methodologies and advanced, large-scale modeling and simulation on critical infrastructure and cyber warfare.
"(D) Lessons learned from the use of novel risk analysis methodologies and large-scale modeling and simulation carried out under the pilot program regarding vulnerabilities, required capabilities, and reconfigured force structure, coordination practices, and policy.
"(E) Planned steps for implementing the lessons described in subparagraph (D).
"(F) Any other matters the Secretary determines appropriate."
Pub. L. 115–232, div. A, title XVI, §1654, Aug. 13, 2018, 132 Stat. 2148, provided that:
"(a)
"(1) A foreign government's activities that pose force protection or cybersecurity risk to the personnel, financial systems, critical infrastructure, or information systems of the United States or coalition forces.
"(2) A foreign government's willingness and record of providing financing, logistics, training or intelligence to other persons, countries or entities posing a force protection or cybersecurity risk to the personnel, financial systems, critical infrastructure, or information systems of the United States or coalition forces.
"(3) A foreign government's engagement in foreign intelligence activities against the United States for the purpose of undermining United States national security.
"(4) A foreign government's knowing participation in transnational organized crime or criminal activity.
"(5) A foreign government's cyber activities and operations to affect the supply chain of the United States Government.
"(6) A foreign government's use of cyber means to unlawfully or inappropriately obtain intellectual property from the United States Government or United States persons.
"(b)
"(c)
(a)
(b)
(2) The congressional defense committees shall ensure that committee procedures designed to protect from unauthorized disclosure classified information relating to national security of the United States are sufficient to protect the information that is submitted to the committees pursuant to this section.
(3) In the event of an unauthorized disclosure of a sensitive military cyber operation covered by this section, the Secretary shall ensure, to the maximum extent practicable, that the congressional defense committees are notified immediately of the sensitive military cyber operation concerned. The notification under this paragraph may be verbal or written, but in the event of a verbal notification a written notification shall be provided by not later than 48 hours after the provision of the verbal notification.
(c)
(A) is carried out by the armed forces of the United States; and
(B) is intended to cause cyber effects outside a geographic location—
(i) where the armed forces of the United States are involved in hostilities (as that term is used in section 1543 of title 50, United States Code); or
(ii) with respect to which hostilities have been declared by the United States.
(2) The actions described in this paragraph are the following:
(A) An offensive cyber operation.
(B) A defensive cyber operation outside the Department of Defense Information Networks to defeat an ongoing or imminent threat.
(d)
(1) to a training exercise conducted with the consent of all nations where the intended effects of the exercise will occur; or
(2) to a covert action (as that term is defined in section 503 of the National Security Act of 1947 (50 U.S.C. 3093)).
(e)
(Added Pub. L. 115–91, div. A, title XVI, §1631(a), Dec. 12, 2017, 131 Stat. 1736, §130j; renumbered §395 and amended Pub. L. 115–232, div. A, title X, §1081(a)(1), title XVI, §1631(a), Aug. 13, 2018, 132 Stat. 1983, 2123.)
The War Powers Resolution, referred to in subsec. (e), is Pub. L. 93–148, Nov. 7, 1973, 87 Stat. 555, which is classified generally to chapter 33 (§1541 et seq.) of Title 50, War and National Defense. For complete classification of this Resolution to the Code, see Short Title note set out under section 1541 of Title 50 and Tables.
The Authorization for Use of Military Force, referred to in subsec. (e), is Pub. L. 107–40, Sept. 18, 2001, 115 Stat. 224, which is set out as a note under section 1541 of Title 50, War and National Defense.
The National Security Act of 1947, referred to in subsec. (e), is act July 26, 1947, ch. 343, 61 Stat. 495, which is classified principally to chapter 44 (§3001 et seq.) of Title 50, War and National Defense. For complete classification of this Act to the Code, see Tables.
2018—Pub. L. 115–232, §1631(a), renumbered section 130j of this title as this section.
Subsec. (d)(2). Pub. L. 115–232, §1081(a)(1), substituted "section 503 of the National Security Act of 1947 (50 U.S.C. 3093)" for "section 3093 of title 50, United States Code".
(a)
(1) With respect to a cyber capability that is intended for use as a weapon, on a quarterly basis, the aggregated results of all reviews of the capability for legality under international law pursuant to Department of Defense Directive 5000.01 carried out by any military department concerned.
(2) The use as a weapon of any cyber capability that has been approved for such use under international law by a military department no later than 48 hours following such use.
(b)
(2) The congressional defense committees shall ensure that committee procedures designed to protect from unauthorized disclosure classified information relating to national security of the United States are sufficient to protect the information that is submitted to the committees pursuant to this section.
(3) In the event of an unauthorized disclosure of a cyber capability covered by this section, the Secretary shall ensure, to the maximum extent practicable, that the congressional defense committees are notified immediately of the cyber capability concerned. The notification under this paragraph may be verbal or written, but in the event of a verbal notification a written notification shall be provided by not later than 48 hours after the provision of the verbal notification.
(c)
(1) to a training exercise conducted with the consent of all nations where the intended effects of the exercise will occur; or
(2) to a covert action (as that term is defined in section 503 of the National Security Act of 1947 (50 U.S.C. 3093)).
(d)
(Added Pub. L. 115–91, div. A, title XVI, §1631(a), Dec. 12, 2017, 131 Stat. 1737, §130k; renumbered §396 and amended Pub. L. 115–232, div. A, title X, §1081(a)(1), title XVI, §1631(a), Aug. 13, 2018, 132 Stat. 1983, 2123.)
The War Powers Resolution, referred to in subsec. (d), is Pub. L. 93–148, Nov. 7, 1973, 87 Stat. 555, which is classified generally to chapter 33 (§1541 et seq.) of Title 50, War and National Defense. For complete classification of this Resolution to the Code, see Short Title note set out under section 1541 of Title 50 and Tables.
The Authorization for Use of Military Force, referred to in subsec. (d), is Pub. L. 107–40, Sept. 18, 2001, 115 Stat. 224, which is set out as a note under section 1541 of Title 50, War and National Defense.
The National Security Act of 1947, referred to in subsec. (d), is act July 26, 1947, ch. 343, 61 Stat. 495, which is classified principally to chapter 44 (§3001 et seq.) of Title 50, War and National Defense. For complete classification of this Act to the Code, see Tables.
2018—Pub. L. 115–232, §1631(a), renumbered section 130k of this title as this section.
Subsec. (c)(2). Pub. L. 115–232, §1081(a)(1), substituted "section 503 of the National Security Act of 1947 (50 U.S.C. 3093)" for "section 3093 of title 50, United States Code".