Iran Cyber Sanctions Act of 2016

Summary: Iran Cyber Sanctions Act of 2016 This bill requires the President to report to Congress at least every 180 days regarding significant activities undermining cybersecurity conducted by Iranian persons against the United States or U.S. persons. The reports must: (1) identify Iranians involved in such activities; (2) describe their conduct; (3) assess the Iranian government's or other foreign governments' material support for such activities; and (4) provide a strategy to counter efforts by Iranian persons to conduct such activities, which shall include engaging foreign governments to halt the capabilities of such Iranian persons. The President must include on the Office of Foreign Assets Control's specially designated nationals and blocked persons list (which identifies individuals and entities whose assets within the United States are blocked from being accessed and with whom U.S. persons are prohibited from engaging in transactions) Iranian persons who are: (1) identified in such reports; or (2) indicted by the Department of Justice in connection with such activities undermining U.S. cybersecurity, unless the President submits an explanation for excluding such a person from that list.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Iran Cyber Sanctions Act of 2016''.

SEC. 2. IMPOSITION OF SANCTIONS WITH RESPECT TO IRANIAN PERSONS 
              RESPONSIBLE FOR KNOWINGLY ENGAGING IN SIGNIFICANT 
              ACTIVITIES UNDERMINING CYBERSECURITY.

    (a) Cybersecurity Report Required.--
            (1) In general.--Not later than 90 days after the date of 
        the enactment of this Act, and not less frequently than once 
        every 180 days thereafter, the President shall submit to the 
        appropriate congressional committees a report that describes 
        significant activities undermining cybersecurity conducted by 
        Iranian persons against the Government of the United States or 
        any United States person.
            (2) Information.--The report required under paragraph (1) 
        shall include the following:
                    (A) The identity of Iranian persons that have 
                knowingly engaged in, directed, or provided material 
                support for significant activities undermining 
                cybersecurity described in paragraph (1).
                    (B) A description of the conduct engaged in by each 
                Iranian person identified under subparagraph (A).
                    (C) An assessment of the extent to which the 
                Government of Iran or another foreign government has 
                provided material support in the conduct of significant 
                activities undermining cybersecurity described in 
                paragraph (1).
                    (D) A strategy to counter efforts by Iranian 
                persons to conduct significant activities undermining 
                cybersecurity described in paragraph (1), including 
                efforts to engage foreign governments to halt the 
                capability of Iranian persons to conduct those 
                activities.
            (3) Form.--The report required under paragraph (1) shall be 
        submitted in unclassified form but may include a classified 
        annex.
    (b) Designation of Persons.--
            (1) In general.--Except as provided in paragraph (2), the 
        President shall include on the specially designated nationals 
        and blocked persons list maintained by the Office of Foreign 
        Assets Control of the Department of the Treasury--
                    (A) any Iranian person identified under subsection 
                (a)(2)(A); and
                    (B) any Iranian person for which the Department of 
                Justice has issued an indictment in connection with 
                significant activities undermining cybersecurity 
                against the Government of the United States or any 
                United States person.
            (2) Exception.--The President is not required to include a 
        person described in paragraph (1)(B) on the specially 
        designated nationals and blocked persons list maintained by the 
        Office of Foreign Assets Control of the Department of the 
        Treasury if the President submits to the appropriate 
        congressional committees an explanation of the reasons for not 
        including that person on that list.
    (c) Presidential Briefings to Congress.--Not later than 180 days 
after the date of the enactment of this Act, and periodically 
thereafter, the President shall provide a briefing to the appropriate 
congressional committees on efforts to implement this section.
    (d) Definitions.--In this section:
            (1) Appropriate congressional committees.--The term 
        ``appropriate congressional committees'' means--
                    (A) the Committee on Foreign Relations, the 
                Committee on Homeland Security and Governmental 
                Affairs, and the Committee on Banking, Housing, and 
                Urban Affairs of the Senate; and
                    (B) the Committee on Foreign Affairs, the Committee 
                on Homeland Security, the Committee on Financial 
                Services, and the Committee on Ways and Means of the 
                House of Representatives.
            (2) Iranian person.--The term ``Iranian person'' means--
                    (A) an individual who is a citizen or national of 
                Iran; and
                    (B) an entity organized under the laws of Iran or 
                otherwise subject to the jurisdiction of the Government 
                of Iran.
            (3) Significant activities undermining cybersecurity.--The 
        term ``significant activities undermining cybersecurity'' 
        includes--
                    (A) significant efforts to--
                            (i) deny access to or degrade, disrupt, or 
                        destroy an information and communications 
                        technology system or network; or
                            (ii) exfiltrate information from such a 
                        system or network without authorization;
                    (B) significant destructive malware attacks;
                    (C) significant denial of service activities; and
                    (D) such other significant activities as may be 
                described in regulations prescribed to implement this 
                section.
            (4) United states person.--The term ``United States 
        person'' means--
                    (A) an individual who is a citizen of the United 
                States or an alien lawfully admitted for permanent 
                residence to the United States; and
                    (B) an entity organized under the laws of the 
                United States or any jurisdiction within the United 
                States, including a foreign branch of such an entity.