```

[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[S. 602 Introduced in Senate (IS)]

<DOC>

116th CONGRESS
  1st Session
                                 S. 602

To address state-sponsored cyber activities against the United States, 
                        and for other purposes.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                           February 28, 2019

Mr. Gardner (for himself and Mr. Coons) introduced the following bill; 
which was read twice and referred to the Committee on Foreign Relations

_______________________________________________________________________

                                 A BILL

 
To address state-sponsored cyber activities against the United States, 
                        and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Cyber Deterrence and Response Act of 
2019''.

SEC. 2. FINDINGS.

    Congress finds the following:
            (1) On February 13, 2018, the Director of National 
        Intelligence stated in his testimony before the Select 
        Committee on Intelligence of the Senate that ``Russia, China, 
        Iran, and North Korea will pose the greatest cyber threats to 
        the United States during the next year'' through the use of 
        cyber operations as low-cost tools of statecraft, and assessed 
        that these countries would ``work to use cyber operations to 
        achieve strategic objectives unless they face clear 
        repercussions for their cyber operations''.
            (2) The 2017 Worldwide Threat Assessment of the United 
        States Intelligence Community stated that ``The potential for 
        surprise in the cyber realm will increase in the next year and 
        beyond as billions more digital devices are connected, with 
        relatively little built-in security, and both nation states and 
        malign actors become more emboldened and better equipped in the 
        use of increasingly widespread cyber toolkits. The risk is 
        growing that some adversaries will conduct cyber attacks, such 
        as data deletion or localized and temporary disruptions of 
        critical infrastructure, against the United States in a crisis 
        short of war.''.
            (3) On March 29, 2017, President Donald J. Trump considered 
        it necessary to continue the national emergency declared in 
        Executive Order 13694 (50 U.S.C. 1701 note; relating to 
        blocking the property of certain persons engaging in 
        significant malicious cyber-enabled activities) as 
        ``Significant malicious cyber-enabled activities originating 
        from, or directed by persons located, in whole or in 
        substantial part, outside the United States, continue to pose 
        an unusual and extraordinary threat to the national security, 
        foreign policy, and economy of the United States.''.
            (4) On January 5, 2017, former Director of National 
        Intelligence, James Clapper, former Under Secretary of Defense 
        for Intelligence, Marcel Lettre, and the Commander of the 
        United States Cyber Command, Admiral Michael Rogers, submitted 
        joint testimony to the Committee on Armed Services of the 
        Senate that stated that ``as of late 2016 more than 30 nations 
        are developing offensive cyber attack capabilities'' and that 
        ``Protecting critical infrastructure, such as crucial energy, 
        financial, manufacturing, transportation, communication, and 
        health systems, will become an increasingly complex national 
        security challenge.''.
            (5) There is significant evidence that hackers affiliated 
        with foreign governments have conducted cyber operations 
        targeting companies and critical infrastructure sectors in the 
        United States as the Department of Justice and the Department 
        of the Treasury have announced that--
                    (A) on March 15, 2018, 5 Russian entities and 19 
                Russian individuals were designated under the 
                Countering America's Adversaries Through Sanctions Act 
                (Public Law 115-44; 131 Stat. 886), as well as pursuant 
                to Executive Order 13694, for interference in the 
                United States elections in 2016 and other malicious 
                cyber-enabled activities;
                    (B) on March 24, 2016, 7 Iranians working for 
                entities affiliated with Iran's Revolutionary Guard 
                Corps were indicted for conducting distributed denial 
                of service attacks against the financial sector in the 
                United States from 2012 to 2013; and
                    (C) on May 19, 2014, 5 Chinese military hackers 
                were charged for hacking United States companies in the 
                nuclear power, metals, and solar products industries, 
                and engaging in economic espionage.
            (6) In May 2017, North Korea released the WannaCry pseudo-
        ransomware, which posed a significant risk to the economy, 
        national security, and the citizens of the United States and 
        the world, as it resulted in the infection of more than 300,000 
        computer systems in more than 150 countries, including in the 
        healthcare sector of the United Kingdom, demonstrating the 
        global reach and cost of cyber-enabled malicious activity.
            (7) In June 2017, Russia carried out the most destructive 
        cyber-enabled operation in history, releasing the NotPetya 
        malware that caused billions of dollars' worth of damage within 
        Ukraine and across Europe, Asia, and the Americas.
            (8) In May 2018, the Department of State, pursuant to 
        section 3(b) of Executive Order 13800 (6 U.S.C. 1501 note 
        prec.; relating to strengthening the cybersecurity of Federal 
        networks and critical infrastructure), prepared recommendations 
        to the President on deterring adversaries and better protecting 
        the people of the United States from cyber threats, which 
        stated ``With respect to activities below the threshold of the 
        use of force, the United States should, working with likeminded 
        partners when possible, adopt an approach of imposing swift, 
        costly, and transparent consequences on foreign governments 
        responsible for significant malicious cyber activities aimed at 
        harming U.S. national interests.''.

SEC. 3. ACTIONS TO ADDRESS STATE-SPONSORED CYBER ACTIVITIES AGAINST THE 
              UNITED STATES.

    (a) Designation as a Critical Cyber Threat Actor.--
            (1) In general.--The President, acting through the 
        Secretary of State, and in coordination with the heads of other 
        relevant Federal agencies, shall designate as a critical cyber 
        threat actor--
                    (A) each foreign person and each agency or 
                instrumentality of a foreign state that the President 
                determines to be knowingly responsible for or complicit 
                in, or to have engaged in, directly or indirectly, 
                state-sponsored cyber activities that are reasonably 
                likely to result in, or have contributed to, a 
                significant threat to the national security, foreign 
                policy, economic health, or financial stability of the 
                United States and that have the purpose or effect of--
                            (i) causing a significant disruption to the 
                        availability of a computer or network of 
                        computers;
                            (ii) harming, or otherwise significantly 
                        compromising the provision of service by, a 
                        computer or network of computers that support 
                        one or more entities in a critical 
                        infrastructure sector;
                            (iii) significantly compromising the 
                        provision of services by one or more entities 
                        in a critical infrastructure sector;
                            (iv) causing a significant misappropriation 
                        of funds or economic resources, trade secrets, 
                        personal identifiers, or financial information 
                        for commercial or competitive advantage or 
                        private financial gain;
                            (v) destabilizing the financial sector of 
                        the United States by tampering with, altering, 
                        or causing a misappropriation of data; or
                            (vi) interfering with or undermining 
                        election processes or institutions by tampering 
                        with, altering, or causing a misappropriation 
                        of data;
                    (B) each foreign person that the President has 
                determined to have knowingly, significantly, and 
                materially assisted, sponsored, or provided financial, 
                material, or technological support for, or goods or 
                services to or in support of, any activities described 
                in subparagraph (A) by a foreign person or agency or 
                instrumentality of a foreign state designated as a 
                critical cyber threat actor under subparagraph (A); and
                    (C) each agency or instrumentality of a foreign 
                state that the President has determined to have 
                significantly and materially assisted, sponsored, or 
                provided financial, material, or technological support 
                for, or goods or services to or in support of, any 
                activities described in subparagraph (A) by a foreign 
                person or agency or instrumentality of a foreign state 
                designated as a critical cyber threat actor under 
                subparagraph (A).
            (2) Transmission to congress.--Not later than 7 days after 
        designating a foreign person or agency or instrumentality of a 
        foreign state as a critical cyber threat actor under paragraph 
        (1), the President shall transmit to the appropriate 
        congressional committees in classified or unclassified form a 
        report identifying the designee.
    (b) Non-Travel-Related Sanctions.--
            (1) In general.--The President shall impose one or more of 
        the sanctions described in paragraph (2) with respect to each 
        foreign person and each agency or instrumentality of a foreign 
        state designated as a critical cyber threat actor under 
        subsection (a).
            (2) Sanctions described.--The sanctions described in this 
        paragraph to be imposed on a foreign person and agency or 
        instrumentality of a foreign state designated as a critical 
        cyber threat actor under subsection (a) are the following:
                    (A) With respect to an agency or instrumentality of 
                a foreign state, the President may provide for the 
                withdrawal, limitation, or suspension of non-
                humanitarian development assistance from the United 
                States to the foreign state under chapter 1 of part I 
                of the Foreign Assistance Act of 1961 (22 U.S.C. 2151 
                et seq.).
                    (B) With respect to an agency or instrumentality of 
                a foreign state, the President may provide for the 
                withdrawal, limitation, or suspension of security 
                assistance from the United States to the foreign state 
                under part II of the Foreign Assistance Act of 1961 (22 
                U.S.C. 2301 et seq.).
                    (C) The President may direct the United States 
                executive director to each international financial 
                institution to use the voice and vote of the United 
                States to oppose any loan from the international 
                financial institution that would benefit the foreign 
                person or agency or instrumentality of a foreign state.
                    (D) The President may direct the Overseas Private 
                Investment Corporation, the United States International 
                Development Finance Corporation, or any other Federal 
                agency not to approve the issuance of any (or to issue 
                a specified number of) guarantees, insurance, 
                extensions of credit, or participations in the 
                extension of credit that would benefit the foreign 
                person or agency or instrumentality of a foreign state.
                    (E) With respect to a foreign person, the President 
                may, pursuant to such regulations or guidelines as the 
                President may prescribe, prohibit any United States 
                person from investing in or purchasing significant 
                amounts of equity or debt instruments of that would 
                benefit the foreign person.
                    (F) The President may, pursuant to procedures the 
                President shall prescribe, which shall include the 
                opportunity to appeal actions under this subparagraph, 
                prohibit any Federal agency from procuring, or entering 
                into any contract for the procurement of, any goods, 
                technology, or services, or classes of goods, 
                technology, or services, from the foreign person or 
                agency or instrumentality of a foreign state.
                    (G) The President may order the heads of the 
                appropriate Federal agencies to not issue any (or to 
                issue a specified number of) specific licenses, and to 
                not grant any other specific authority (or to grant a 
                specified number of authorities), to export any goods 
                or technology to the foreign person or agency or 
                instrumentality of a foreign state under--
                            (i) the Export Control Reform Act of 2018 
                        (50 U.S.C. 4801 et seq.);
                            (ii) the Arms Export Control Act (22 U.S.C. 
                        2751 et seq.);
                            (iii) the Atomic Energy Act of 1954 (42 
                        U.S.C. 2011 et seq.); or
                            (iv) any other statute that requires the 
                        prior review and approval of the United States 
                        Government as a condition for the export or 
                        reexport of goods or services.
                    (H) With respect to a foreign person, the President 
                may exercise all of the powers granted to the President 
                under the International Emergency Economic Powers Act 
                (50 U.S.C. 1701 et seq.) (except that the requirements 
                of section 202 of such Act (50 U.S.C. 1701) shall not 
                apply) to the extent necessary to block and prohibit 
                all transactions in property and interests in property 
                of the foreign person if such property and interests in 
                property are in the United States, come within the 
                United States, or are or come within the possession or 
                control of a United States person.
                    (I) With respect to a foreign person, the President 
                may, pursuant to such regulations as the President may 
                prescribe, prohibit any transfers of credit or payments 
                between one or more financial institutions or by, 
                through, or to any financial institution, to the extent 
                that such transfers or payments are subject to the 
                jurisdiction of the United States and involve any 
                interest of the foreign person.
    (c) Travel-Related Sanctions.--
            (1) Aliens ineligible for visas, admission, or parole.--An 
        alien who is designated as a critical cyber threat actor under 
        subsection (a) is--
                    (A) inadmissible to the United States;
                    (B) ineligible to receive a visa or other 
                documentation to enter the United States; and
                    (C) otherwise ineligible to be admitted or paroled 
                into the United States or to receive any other benefit 
                under the Immigration and Nationality Act (8 U.S.C. 
                1101 et seq.).
            (2) Current visas revoked.--
                    (A) In general.--The issuing consular officer, the 
                Secretary of State, or the Secretary of Homeland 
                Security (or a designee of either such Secretary) shall 
                revoke any visa or other entry documentation issued to 
                a foreign person who is a designated as a critical 
                cyber threat actor under subsection (a) regardless of 
                when issued.
                    (B) Effect.--A revocation under subparagraph (A) 
                with respect to a foreign person shall take effect 
                immediately and shall automatically cancel any other 
                valid visa or entry documentation that is in the 
                possession of the foreign person.
    (d) Additional Sanctions With Respect to Foreign States.--
            (1) In general.--The President may impose any of the 
        sanctions described in paragraph (2) with respect to the 
        government of a foreign state that the President has determined 
        aided, abetted, or directed a foreign person or agency or 
        instrumentality of a foreign state that is designated as a 
        critical cyber threat actor under subsection (a).
            (2) Sanctions described.--The sanctions described in this 
        paragraph with respect to the government of a foreign state are 
        the following:
                    (A) The President may provide for the withdrawal, 
                limitation, or suspension of non-humanitarian or non-
                trade-related development assistance from the United 
                States to the foreign state under chapter 1 of part I 
                of the Foreign Assistance Act of 1961 (22 U.S.C. 2151 
                et seq.).
                    (B) The President may provide for the withdrawal, 
                limitation, or suspension of security assistance from 
                the United States to the foreign state under part II of 
                the Foreign Assistance Act of 1961 (22 U.S.C. 2301 et 
                seq.).
                    (C) The President may direct the United States 
                executive director to each international financial 
                institution to use the voice and vote of the United 
                States to oppose the extension by such institution of 
                any loan or financial assistance to the government of 
                the foreign state.
                    (D) No item on the United States Munitions List 
                under section 38(a)(1) of the Arms Export Control Act 
                (22 U.S.C. 2778(a)(1)) or the Commerce Control List set 
                forth in Supplement No. 1 to part 774 of the Export 
                Administration Regulations under subchapter C of 
                chapter VII of title 15, Code of Federal Regulations 
                (or any successor list established pursuant to section 
                1754(a)(1) of the Export Control Reform Act of 2018 (50 
                U.S.C. 4813(a)(1))), may be exported to the government 
                of the foreign state.
    (e) Implementation.--The President may exercise all authorities 
provided under sections 203 and 205 of the International Emergency 
Economic Powers Act (50 U.S.C. 1702 and 1704) to carry out this 
section.
    (f) Penalties.--The penalties provided for in subsections (b) and 
(c) of section 206 of the International Emergency Economic Powers Act 
(50 U.S.C. 1705) shall apply to a person that violates, attempts to 
violate, conspires to violate, or causes a violation of subsection 
(b)(2)(H) or regulations prescribed under subsection (b)(2)(H) to the 
same extent that such penalties apply to a person that commits an 
unlawful act described in subsection (a) of such section 206.
    (g) Coordination.--To the extent practicable--
            (1) actions taken by the President pursuant to this section 
        should be coordinated with allies and partners of the United 
        States; and
            (2) the Secretary of State should work with allies and 
        partners of the United States, on a voluntary basis, to lead an 
        international diplomatic initiative to--
                    (A) deter critical cyber threat actors and state-
                sponsored cyber activities; and
                    (B) provide mutual support to such allies and 
                partners participating in such initiative to respond to 
                such state-sponsored cyber activities.
    (h) Exemptions, Waivers, and Removals of Sanctions and 
Designations.--
            (1) Mandatory exemptions.--The following activities shall 
        be exempt from sanctions under subsections (b), (c), and (d):
                    (A) Activities subject to the reporting 
                requirements of title V of the National Security Act of 
                1947 (50 U.S.C. 3091 et seq.) or to any authorized 
                intelligence activities of the United States.
                    (B) Any transaction necessary to comply with the 
                Agreement regarding the Headquarters of the United 
                Nations, signed at Lake Success June 26, 1947, and 
                entered into force November 21, 1947, between the 
                United Nations and the United States, the Convention on 
                Consular Relations, done at Vienna April 24, 1963, and 
                entered into force March 19, 1967, or other applicable 
                international obligations.
            (2) Waiver.--The President may waive the imposition of 
        sanctions described in this section for a period of not more 
        than one year, and may renew such waiver for additional periods 
        of not more than one year, if the President submits to the 
        appropriate congressional committees a written determination 
        that such waiver meets one or more of the following 
        requirements:
                    (A) Such waiver is in the national interests of the 
                United States.
                    (B) Such waiver will further the enforcement of 
                this section or is for an important law enforcement 
                purpose.
                    (C) Such waiver is for an important humanitarian 
                purpose.
            (3) Removals of sanctions and designations.--The President 
        may prescribe rules and regulations for the removal of 
        sanctions under subsections (b), (c), and (d) and the removal 
        of designations under subsection (a) if the President 
        determines that a foreign person, agency or instrumentality of 
        a foreign state, or government of a foreign state subject to 
        such sanctions or designation, as the case may be, has 
        verifiably ceased its participation in any of the conduct with 
        respect to which such foreign person, agency or instrumentality 
        of a foreign state, or government of a foreign state was 
        subject to such sanctions or designation, as the case may be, 
        under this section, and has given assurances that such foreign 
        person, agency or instrumentality of a foreign state, or 
        government of a foreign state, as the case may be, will no 
        longer participate in such conduct.
            (4) Exception to comply with united nations headquarters 
        agreement.--Sanctions under subsection (c) shall not apply to a 
        foreign person if admitting such foreign person into the United 
        States is necessary to permit the United States to comply with 
        the Agreement regarding the Headquarters of the United Nations, 
        signed at Lake Success June 26, 1947, and entered into force 
        November 21, 1947, between the United Nations and the United 
        States, or other applicable international obligations.
    (i) Rule of Construction.--Nothing in this section may be construed 
to limit the authority of the President under the International 
Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) or any other 
provision of law to impose sanctions to address critical cyber threat 
actors and malicious state-sponsored cyber activities.
    (j) Definitions.--In this section:
            (1) Admitted; alien.--The terms ``admitted'' and ``alien'' 
        have the meanings given those terms in section 101 of the 
        Immigration and Nationality Act (8 U.S.C. 1101).
            (2) Agency or instrumentality of a foreign state.--The term 
        ``agency or instrumentality of a foreign state'' has the 
        meaning given that term in section 1603(b) of title 28, United 
        States Code.
            (3) Appropriate congressional committees.--The term 
        ``appropriate congressional committees'' means--
                    (A) the Committee on Foreign Relations, the 
                Committee on Banking, Housing, and Urban Affairs, the 
                Committee on the Judiciary, and the Committee on 
                Homeland Security and Governmental Affairs of the 
                Senate; and
                    (B) the Committee on Foreign Affairs, the Committee 
                on Financial Services, the Committee on the Judiciary, 
                the Committee on Oversight and Reform, and the 
                Committee on Homeland Security of the House of 
                Representatives.
            (4) Critical infrastructure sector.--The term ``critical 
        infrastructure sector'' means any of the designated critical 
        infrastructure sectors identified in the Presidential Policy 
        Directive entitled ``Critical Infrastructure Security and 
        Resilience'', numbered 21, and dated February 12, 2013.
            (5) Foreign person.--The term ``foreign person'' means a 
        person that is not a United States person.
            (6) Foreign state.--The term ``foreign state'' has the 
        meaning given that term in section 1603(a) of title 28, United 
        States Code.
            (7) Knowingly.--The term ``knowingly'', with respect to 
        conduct, a circumstance, or a result, means that a person has 
        actual knowledge, or should have known, of the conduct, the 
        circumstance, or the result.
            (8) Misappropriation.--The term ``misappropriation'' means 
        taking or obtaining by improper means, without permission or 
        consent, or under false pretenses.
            (9) State-sponsored cyber activities.--The term ``state-
        sponsored cyber activities'' means any malicious cyber-enabled 
        activities that--
                    (A) are carried out by a government of a foreign 
                state or an agency or instrumentality of a foreign 
                state; or
                    (B) are carried out by a foreign person that is 
                aided, abetted, or directed by a government of a 
                foreign state or an agency or instrumentality of a 
                foreign state.
            (10) United states person.--The term ``United States 
        person'' means--
                    (A) a United States citizen or an alien lawfully 
                admitted for permanent residence to the United States; 
                or
                    (B) an entity organized under the laws of the 
                United States or of any jurisdiction within the United 
                States, including a foreign branch of such an entity.

SEC. 4. SENSE OF CONGRESS ON IMPLEMENTATION OF CYBERSECURITY 
              COOPERATION BETWEEN THE UNITED STATES AND NATIONS IN THE 
              INDO-PACIFIC REGION.

    It is the sense of Congress that the President is encouraged to 
fully implement robust cybersecurity cooperation between the United 
States and nations in the Indo-Pacific region as described in section 
215 of the Asia Reassurance Initiative Act of 2018 (Public Law 115-
409).
                                 <all>
```