IIB 

112TH CONGRESS 

2D SESSION H. R. 3523 

IN THE SENATE OF THE UNITED STATES 

MAY 7, 2012 

Received; read twice and referred to the Select Committee on Intelligence 

AN ACT 

To provide for the sharing of certain cyber threat intelligence 

and cyber threat information between the intelligence 

community and cybersecurity entities, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


tjames on DSK6SPTVN1PROD with BILLS
2 

HR 3523 RFS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Cyber Intelligence 

3 Sharing and Protection Act’’. 

4 SEC. 2. CYBER THREAT INTELLIGENCE AND INFORMATION 

5 SHARING. 

6 (a) IN GENERAL.—Title XI of the National Security 

7 Act of 1947 (50 U.S.C. 442 et seq.) is amended by adding 

8 at the end the following new section: 

9 ‘‘CYBER THREAT INTELLIGENCE AND INFORMATION

10 SHARING

11 ‘‘SEC. 1104. (a) INTELLIGENCE COMMUNITY SHAR12 ING OF CYBER THREAT INTELLIGENCE WITH PRIVATE

13 SECTOR AND UTILITIES.— 

14 ‘‘(1) IN GENERAL.—The Director of National 

15 Intelligence shall establish procedures to allow ele16 ments of the intelligence community to share cyber 

17 threat intelligence with private-sector entities and 

18 utilities and to encourage the sharing of such intel19 ligence. 

20 ‘‘(2) SHARING AND USE OF CLASSIFIED INTEL21 LIGENCE.—The procedures established under para22 graph (1) shall provide that classified cyber threat 

23 intelligence may only be— 

24 ‘‘(A) shared by an element of the intel25 ligence community with— 

26 ‘‘(i) certified entities; or 


tjames on DSK6SPTVN1PROD with BILLS
3 

HR 3523 RFS

1 ‘‘(ii) a person with an appropriate se2 curity clearance to receive such cyber 

3 threat intelligence; 

4 ‘‘(B) shared consistent with the need to 

5 protect the national security of the United 

6 States; and 

7 ‘‘(C) used by a certified entity in a manner 

8 which protects such cyber threat intelligence 

9 from unauthorized disclosure. 

10 ‘‘(3) SECURITY CLEARANCE APPROVALS.—The 

11 Director of National Intelligence shall issue guide12 lines providing that the head of an element of the 

13 intelligence community may, as the head of such ele14 ment considers necessary to carry out this sub15 section— 

16 ‘‘(A) grant a security clearance on a tem17 porary or permanent basis to an employee or 

18 officer of a certified entity; 

19 ‘‘(B) grant a security clearance on a tem20 porary or permanent basis to a certified entity 

21 and approval to use appropriate facilities; and 

22 ‘‘(C) expedite the security clearance proc23 ess for a person or entity as the head of such 

24 element considers necessary, consistent with the 


tjames on DSK6SPTVN1PROD with BILLS
4 

HR 3523 RFS

1 need to protect the national security of the 

2 United States. 

3 ‘‘(4) NO RIGHT OR BENEFIT.—The provision of 

4 information to a private-sector entity or a utility 

5 under this subsection shall not create a right or ben6 efit to similar information by such entity or such 

7 utility or any other private-sector entity or utility. 

8 ‘‘(5) RESTRICTION ON DISCLOSURE OF CYBER

9 THREAT INTELLIGENCE.—Notwithstanding any 

10 other provision of law, a certified entity receiving 

11 cyber threat intelligence pursuant to this subsection 

12 shall not further disclose such cyber threat intel13 ligence to another entity, other than to a certified 

14 entity or other appropriate agency or department of 

15 the Federal Government authorized to receive such 

16 cyber threat intelligence. 

17 ‘‘(b) USE OF CYBERSECURITY SYSTEMS AND SHAR18 ING OF CYBER THREAT INFORMATION.— 

19 ‘‘(1) IN GENERAL.— 

20 ‘‘(A) CYBERSECURITY PROVIDERS.—Not21 withstanding any other provision of law, a cy22 bersecurity provider, with the express consent 

23 of a protected entity for which such cybersecu24 rity provider is providing goods or services for 


tjames on DSK6SPTVN1PROD with BILLS
5 

HR 3523 RFS

1 cybersecurity purposes, may, for cybersecurity 

2 purposes— 

3 ‘‘(i) use cybersecurity systems to iden4 tify and obtain cyber threat information to 

5 protect the rights and property of such 

6 protected entity; and 

7 ‘‘(ii) share such cyber threat informa8 tion with any other entity designated by 

9 such protected entity, including, if specifi10 cally designated, the Federal Government. 

11 ‘‘(B) SELF-PROTECTED ENTITIES.—Not12 withstanding any other provision of law, a self13 protected entity may, for cybersecurity pur14 poses— 

15 ‘‘(i) use cybersecurity systems to iden16 tify and obtain cyber threat information to 

17 protect the rights and property of such 

18 self-protected entity; and 

19 ‘‘(ii) share such cyber threat informa20 tion with any other entity, including the 

21 Federal Government. 

22 ‘‘(2) SHARING WITH THE FEDERAL GOVERN23 MENT.— 

24 ‘‘(A) INFORMATION SHARED WITH THE

25 NATIONAL CYBERSECURITY AND COMMUNICAVerDate Mar 15 2010 01:21 May 08, 2012 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3523.RFS H3523

tjames on DSK6SPTVN1PROD with BILLS
6 

HR 3523 RFS

1 TIONS INTEGRATION CENTER OF THE DEPART2 MENT OF HOMELAND SECURITY.—Subject to 

3 the use and protection of information require4 ments under paragraph (3), the head of a de5 partment or agency of the Federal Government 

6 receiving cyber threat information in accordance 

7 with paragraph (1) shall provide such cyber 

8 threat information to the National Cybersecu9 rity and Communications Integration Center of 

10 the Department of Homeland Security. 

11 ‘‘(B) REQUEST TO SHARE WITH ANOTHER

12 DEPARTMENT OR AGENCY OF THE FEDERAL

13 GOVERNMENT.—An entity sharing cyber threat 

14 information that is provided to the National Cy15 bersecurity and Communications Integration 

16 Center of the Department of Homeland Secu17 rity under subparagraph (A) or paragraph (1) 

18 may request the head of such Center to, and 

19 the head of such Center may, provide such in20 formation to another department or agency of 

21 the Federal Government. 

22 ‘‘(3) USE AND PROTECTION OF INFORMA23 TION.—Cyber threat information shared in accord24 ance with paragraph (1)— 


tjames on DSK6SPTVN1PROD with BILLS
7 

HR 3523 RFS

1 ‘‘(A) shall only be shared in accordance 

2 with any restrictions placed on the sharing of 

3 such information by the protected entity or self4 protected entity authorizing such sharing, in5 cluding appropriate anonymization or minimiza6 tion of such information; 

7 ‘‘(B) may not be used by an entity to gain 

8 an unfair competitive advantage to the det9 riment of the protected entity or the self-pro10 tected entity authorizing the sharing of infor11 mation; 

12 ‘‘(C) if shared with the Federal Govern13 ment— 

14 ‘‘(i) shall be exempt from disclosure 

15 under section 552 of title 5, United States 

16 Code; 

17 ‘‘(ii) shall be considered proprietary 

18 information and shall not be disclosed to 

19 an entity outside of the Federal Govern20 ment except as authorized by the entity 

21 sharing such information; 

22 ‘‘(iii) shall not be used by the Federal 

23 Government for regulatory purposes; 

24 ‘‘(iv) shall not be provided by the de25 partment or agency of the Federal GovernVerDate Mar 15 2010 01:21 May 08, 2012 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H3523.RFS H3523

tjames on DSK6SPTVN1PROD with BILLS
8 

HR 3523 RFS

1 ment receiving such cyber threat informa2 tion to another department or agency of 

3 the Federal Government under paragraph 

4 (2)(A) if— 

5 ‘‘(I) the entity providing such in6 formation determines that the provi7 sion of such information will under8 mine the purpose for which such in9 formation is shared; or 

10 ‘‘(II) unless otherwise directed by 

11 the President, the head of the depart12 ment or agency of the Federal Gov13 ernment receiving such cyber threat 

14 information determines that the provi15 sion of such information will under16 mine the purpose for which such in17 formation is shared; and 

18 ‘‘(v) shall be handled by the Federal 

19 Government consistent with the need to 

20 protect sources and methods and the na21 tional security of the United States; and 

22 ‘‘(D) shall be exempt from disclosure 

23 under a State, local, or tribal law or regulation 

24 that requires public disclosure of information by 

25 a public or quasi-public entity. 


tjames on DSK6SPTVN1PROD with BILLS
9 

HR 3523 RFS

1 ‘‘(4) EXEMPTION FROM LIABILITY.—No civil or 

2 criminal cause of action shall lie or be maintained in 

3 Federal or State court against a protected entity, 

4 self-protected entity, cybersecurity provider, or an 

5 officer, employee, or agent of a protected entity, self6 protected entity, or cybersecurity provider, acting in 

7 good faith— 

8 ‘‘(A) for using cybersecurity systems to 

9 identify or obtain cyber threat information or 

10 for sharing such information in accordance with 

11 this section; or 

12 ‘‘(B) for decisions made based on cyber 

13 threat information identified, obtained, or 

14 shared under this section. 

15 ‘‘(5) RELATIONSHIP TO OTHER LAWS REQUIR16 ING THE DISCLOSURE OF INFORMATION.—The sub17 mission of information under this subsection to the 

18 Federal Government shall not satisfy or affect— 

19 ‘‘(A) any requirement under any other pro20 vision of law for a person or entity to provide 

21 information to the Federal Government; or 

22 ‘‘(B) the applicability of other provisions of 

23 law, including section 552 of title 5, United 

24 States Code (commonly known as the ‘Freedom 

25 of Information Act’), with respect to informaVerDate Mar 15 2010 01:21 May 08, 2012 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H3523.RFS H3523

tjames on DSK6SPTVN1PROD with BILLS
10 

HR 3523 RFS

1 tion required to be provided to the Federal Gov2 ernment under such other provision of law. 

3 ‘‘(c) FEDERAL GOVERNMENT USE OF INFORMA4 TION.— 

5 ‘‘(1) LIMITATION.—The Federal Government 

6 may use cyber threat information shared with the 

7 Federal Government in accordance with subsection 

8 (b)— 

9 ‘‘(A) for cybersecurity purposes; 

10 ‘‘(B) for the investigation and prosecution 

11 of cybersecurity crimes; 

12 ‘‘(C) for the protection of individuals from 

13 the danger of death or serious bodily harm and 

14 the investigation and prosecution of crimes in15 volving such danger of death or serious bodily 

16 harm; 

17 ‘‘(D) for the protection of minors from 

18 child pornography, any risk of sexual exploi19 tation, and serious threats to the physical safe20 ty of such minor, including kidnapping and 

21 trafficking and the investigation and prosecu22 tion of crimes involving child pornography, any 

23 risk of sexual exploitation, and serious threats 

24 to the physical safety of minors, including kid25 napping and trafficking, and any crime referred 


tjames on DSK6SPTVN1PROD with BILLS
11 

HR 3523 RFS

1 to in 2258A(a)(2) of title 18, United States 

2 Code; or 

3 ‘‘(E) to protect the national security of the 

4 United States. 

5 ‘‘(2) AFFIRMATIVE SEARCH RESTRICTION.— 

6 The Federal Government may not affirmatively 

7 search cyber threat information shared with the 

8 Federal Government under subsection (b) for a pur9 pose other than a purpose referred to in paragraph 

10 (1)(B). 

11 ‘‘(3) ANTI-TASKING RESTRICTION.—Nothing in 

12 this section shall be construed to permit the Federal 

13 Government to— 

14 ‘‘(A) require a private-sector entity to 

15 share information with the Federal Govern16 ment; or 

17 ‘‘(B) condition the sharing of cyber threat 

18 intelligence with a private-sector entity on the 

19 provision of cyber threat information to the 

20 Federal Government. 

21 ‘‘(4) PROTECTION OF SENSITIVE PERSONAL

22 DOCUMENTS.—The Federal Government may not 

23 use the following information, containing informa24 tion that identifies a person, shared with the Federal 

25 Government in accordance with subsection (b): 


tjames on DSK6SPTVN1PROD with BILLS
12 

HR 3523 RFS

1 ‘‘(A) Library circulation records. 

2 ‘‘(B) Library patron lists. 

3 ‘‘(C) Book sales records. 

4 ‘‘(D) Book customer lists. 

5 ‘‘(E) Firearms sales records. 

6 ‘‘(F) Tax return records. 

7 ‘‘(G) Educational records. 

8 ‘‘(H) Medical records. 

9 ‘‘(5) NOTIFICATION OF NON-CYBER THREAT IN10 FORMATION.—If a department or agency of the Fed11 eral Government receiving information pursuant to 

12 subsection (b)(1) determines that such information 

13 is not cyber threat information, such department or 

14 agency shall notify the entity or provider sharing 

15 such information pursuant to subsection (b)(1). 

16 ‘‘(6) RETENTION AND USE OF CYBER THREAT

17 INFORMATION.—No department or agency of the 

18 Federal Government shall retain or use information 

19 shared pursuant to subsection (b)(1) for any use 

20 other than a use permitted under subsection (c)(1). 

21 ‘‘(7) PROTECTION OF INDIVIDUAL INFORMA22 TION.—The Federal Government may, consistent 

23 with the need to protect Federal systems and critical 

24 information infrastructure from cybersecurity 

25 threats and to mitigate such threats, undertake reaVerDate Mar 15 2010 01:21 May 08, 2012 Jkt 019200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H3523.RFS H3523

tjames on DSK6SPTVN1PROD with BILLS
13 

HR 3523 RFS

1 sonable efforts to limit the impact on privacy and 

2 civil liberties of the sharing of cyber threat informa3 tion with the Federal Government pursuant to this 

4 subsection. 

5 ‘‘(d) FEDERAL GOVERNMENT LIABILITY FOR VIOLA6 TIONS OF RESTRICTIONS ON THE DISCLOSURE, USE, AND

7 PROTECTION OF VOLUNTARILY SHARED INFORMATION.— 

8 ‘‘(1) IN GENERAL.—If a department or agency 

9 of the Federal Government intentionally or willfully 

10 violates subsection (b)(3)(C) or subsection (c) with 

11 respect to the disclosure, use, or protection of volun12 tarily shared cyber threat information shared under 

13 this section, the United States shall be liable to a 

14 person adversely affected by such violation in an 

15 amount equal to the sum of— 

16 ‘‘(A) the actual damages sustained by the 

17 person as a result of the violation or $1,000, 

18 whichever is greater; and 

19 ‘‘(B) the costs of the action together with 

20 reasonable attorney fees as determined by the 

21 court. 

22 ‘‘(2) VENUE.—An action to enforce liability cre23 ated under this subsection may be brought in the 

24 district court of the United States in— 


tjames on DSK6SPTVN1PROD with BILLS
14 

HR 3523 RFS

1 ‘‘(A) the district in which the complainant 

2 resides; 

3 ‘‘(B) the district in which the principal 

4 place of business of the complainant is located; 

5 ‘‘(C) the district in which the department 

6 or agency of the Federal Government that dis7 closed the information is located; or 

8 ‘‘(D) the District of Columbia. 

9 ‘‘(3) STATUTE OF LIMITATIONS.—No action 

10 shall lie under this subsection unless such action is 

11 commenced not later than two years after the date 

12 of the violation of subsection (b)(3)(C) or subsection 

13 (c) that is the basis for the action. 

14 ‘‘(4) EXCLUSIVE CAUSE OF ACTION.—A cause 

15 of action under this subsection shall be the exclusive 

16 means available to a complainant seeking a remedy 

17 for a violation of subsection (b)(3)(C) or subsection 

18 (c). 

19 ‘‘(e) REPORT ON INFORMATION SHARING.— 

20 ‘‘(1) REPORT.—The Inspector General of the 

21 Intelligence Community shall annually submit to the 

22 congressional intelligence committees a report con23 taining a review of the use of information shared 

24 with the Federal Government under this section, in25 cluding— 


tjames on DSK6SPTVN1PROD with BILLS
15 

HR 3523 RFS

1 ‘‘(A) a review of the use by the Federal 

2 Government of such information for a purpose 

3 other than a cybersecurity purpose; 

4 ‘‘(B) a review of the type of information 

5 shared with the Federal Government under this 

6 section; 

7 ‘‘(C) a review of the actions taken by the 

8 Federal Government based on such information; 

9 ‘‘(D) appropriate metrics to determine the 

10 impact of the sharing of such information with 

11 the Federal Government on privacy and civil 

12 liberties, if any; 

13 ‘‘(E) a list of the department or agency re14 ceiving such information; 

15 ‘‘(F) a review of the sharing of such infor16 mation within the Federal Government to iden17 tify inappropriate stovepiping of shared infor18 mation; and 

19 ‘‘(G) any recommendations of the Inspec20 tor General for improvements or modifications 

21 to the authorities under this section. 

22 ‘‘(2) FORM.—Each report required under para23 graph (1) shall be submitted in unclassified form, 

24 but may include a classified annex. 


tjames on DSK6SPTVN1PROD with BILLS
16 

HR 3523 RFS

1 ‘‘(f) FEDERAL PREEMPTION.—This section super2 sedes any statute of a State or political subdivision of a 

3 State that restricts or otherwise expressly regulates an ac4 tivity authorized under subsection (b). 

5 ‘‘(g) SAVINGS CLAUSES.— 

6 ‘‘(1) EXISTING AUTHORITIES.—Nothing in this 

7 section shall be construed to limit any other author8 ity to use a cybersecurity system or to identify, ob9 tain, or share cyber threat intelligence or cyber 

10 threat information. 

11 ‘‘(2) LIMITATION ON MILITARY AND INTEL12 LIGENCE COMMUNITY INVOLVEMENT IN PRIVATE

13 AND PUBLIC SECTOR CYBERSECURITY EFFORTS.— 

14 Nothing in this section shall be construed to provide 

15 additional authority to, or modify an existing au16 thority of, the Department of Defense or the Na17 tional Security Agency or any other element of the 

18 intelligence community to control, modify, require, 

19 or otherwise direct the cybersecurity efforts of a pri20 vate-sector entity or a component of the Federal 

21 Government or a State, local, or tribal government. 

22 ‘‘(3) INFORMATION SHARING RELATIONSHIPS.— 

23 Nothing in this section shall be construed to— 

24 ‘‘(A) limit or modify an existing informa25 tion sharing relationship; 


tjames on DSK6SPTVN1PROD with BILLS
17 

HR 3523 RFS

1 ‘‘(B) prohibit a new information sharing 

2 relationship; 

3 ‘‘(C) require a new information sharing re4 lationship between the Federal Government and 

5 a private-sector entity; or 

6 ‘‘(D) modify the authority of a department 

7 or agency of the Federal Government to protect 

8 sources and methods and the national security 

9 of the United States. 

10 ‘‘(4) LIMITATION ON FEDERAL GOVERNMENT

11 USE OF CYBERSECURITY SYSTEMS.—Nothing in this 

12 section shall be construed to provide additional au13 thority to, or modify an existing authority of, any 

14 entity to use a cybersecurity system owned or con15 trolled by the Federal Government on a private-sec16 tor system or network to protect such private-sector 

17 system or network. 

18 ‘‘(5) NO LIABILITY FOR NON-PARTICIPATION.— 

19 Nothing in this section shall be construed to subject 

20 a protected entity, self-protected entity, cyber secu21 rity provider, or an officer, employee, or agent of a 

22 protected entity, self-protected entity, or cybersecu23 rity provider, to liability for choosing not to engage 

24 in the voluntary activities authorized under this sec25 tion. 


tjames on DSK6SPTVN1PROD with BILLS
18 

HR 3523 RFS

1 ‘‘(6) USE AND RETENTION OF INFORMATION.— 

2 Nothing in this section shall be construed to author3 ize, or to modify any existing authority of, a depart4 ment or agency of the Federal Government to retain 

5 or use information shared pursuant to subsection 

6 (b)(1) for any use other than a use permitted under 

7 subsection (c)(1). 

8 ‘‘(h) DEFINITIONS.—In this section: 

9 ‘‘(1) AVAILABILITY.—The term ‘availability’ 

10 means ensuring timely and reliable access to and use 

11 of information. 

12 ‘‘(2) CERTIFIED ENTITY.—The term ‘certified 

13 entity’ means a protected entity, self-protected enti14 ty, or cybersecurity provider that— 

15 ‘‘(A) possesses or is eligible to obtain a se16 curity clearance, as determined by the Director 

17 of National Intelligence; and 

18 ‘‘(B) is able to demonstrate to the Director 

19 of National Intelligence that such provider or 

20 such entity can appropriately protect classified 

21 cyber threat intelligence. 

22 ‘‘(3) CONFIDENTIALITY.—The term ‘confiden23 tiality’ means preserving authorized restrictions on 

24 access and disclosure, including means for protecting 

25 personal privacy and proprietary information. 


tjames on DSK6SPTVN1PROD with BILLS
19 

HR 3523 RFS

1 ‘‘(4) CYBER THREAT INFORMATION.— 

2 ‘‘(A) IN GENERAL.—The term ‘cyber 

3 threat information’ means information directly 

4 pertaining to— 

5 ‘‘(i) a vulnerability of a system or net6 work of a government or private entity; 

7 ‘‘(ii) a threat to the integrity, con8 fidentiality, or availability of a system or 

9 network of a government or private entity 

10 or any information stored on, processed on, 

11 or transiting such a system or network; 

12 ‘‘(iii) efforts to deny access to or de13 grade, disrupt, or destroy a system or net14 work of a government or private entity; or 

15 ‘‘(iv) efforts to gain unauthorized ac16 cess to a system or network of a govern17 ment or private entity, including to gain 

18 such unauthorized access for the purpose 

19 of exfiltrating information stored on, proc20 essed on, or transiting a system or network 

21 of a government or private entity. 

22 ‘‘(B) EXCLUSION.—Such term does not in23 clude information pertaining to efforts to gain 

24 unauthorized access to a system or network of 

25 a government or private entity that solely inVerDate Mar 15 2010 01:21 May 08, 2012 Jkt 019200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\H3523.RFS H3523

tjames on DSK6SPTVN1PROD with BILLS
20 

HR 3523 RFS

1 volve violations of consumer terms of service or 

2 consumer licensing agreements and do not oth3 erwise constitute unauthorized access. 

4 ‘‘(5) CYBER THREAT INTELLIGENCE.— 

5 ‘‘(A) IN GENERAL.—The term ‘cyber 

6 threat intelligence’ means intelligence in the 

7 possession of an element of the intelligence 

8 community directly pertaining to— 

9 ‘‘(i) a vulnerability of a system or net10 work of a government or private entity; 

11 ‘‘(ii) a threat to the integrity, con12 fidentiality, or availability of a system or 

13 network of a government or private entity 

14 or any information stored on, processed on, 

15 or transiting such a system or network; 

16 ‘‘(iii) efforts to deny access to or de17 grade, disrupt, or destroy a system or net18 work of a government or private entity; or 

19 ‘‘(iv) efforts to gain unauthorized ac20 cess to a system or network of a govern21 ment or private entity, including to gain 

22 such unauthorized access for the purpose 

23 of exfiltrating information stored on, proc24 essed on, or transiting a system or network 

25 of a government or private entity. 


tjames on DSK6SPTVN1PROD with BILLS
21 

HR 3523 RFS

1 ‘‘(B) EXCLUSION.—Such term does not in2 clude intelligence pertaining to efforts to gain 

3 unauthorized access to a system or network of 

4 a government or private entity that solely in5 volve violations of consumer terms of service or 

6 consumer licensing agreements and do not oth7 erwise constitute unauthorized access. 

8 ‘‘(6) CYBERSECURITY CRIME.—The term ‘cy9 bersecurity crime’ means— 

10 ‘‘(A) a crime under a Federal or State law 

11 that involves— 

12 ‘‘(i) efforts to deny access to or de13 grade, disrupt, or destroy a system or net14 work; 

15 ‘‘(ii) efforts to gain unauthorized ac16 cess to a system or network; or 

17 ‘‘(iii) efforts to exfiltrate information 

18 from a system or network without author19 ization; or 

20 ‘‘(B) the violation of a provision of Federal 

21 law relating to computer crimes, including a 

22 violation of any provision of title 18, United 

23 States Code, created or amended by the Com24 puter Fraud and Abuse Act of 1986 (Public 

25 Law 99–474). 


tjames on DSK6SPTVN1PROD with BILLS
22 

HR 3523 RFS

1 ‘‘(7) CYBERSECURITY PROVIDER.—The term 

2 ‘cybersecurity provider’ means a non-governmental 

3 entity that provides goods or services intended to be 

4 used for cybersecurity purposes. 

5 ‘‘(8) CYBERSECURITY PURPOSE.— 

6 ‘‘(A) IN GENERAL.—The term ‘cybersecu7 rity purpose’ means the purpose of ensuring the 

8 integrity, confidentiality, or availability of, or 

9 safeguarding, a system or network, including 

10 protecting a system or network from— 

11 ‘‘(i) a vulnerability of a system or net12 work; 

13 ‘‘(ii) a threat to the integrity, con14 fidentiality, or availability of a system or 

15 network or any information stored on, 

16 processed on, or transiting such a system 

17 or network; 

18 ‘‘(iii) efforts to deny access to or de19 grade, disrupt, or destroy a system or net20 work; or 

21 ‘‘(iv) efforts to gain unauthorized ac22 cess to a system or network, including to 

23 gain such unauthorized access for the pur24 pose of exfiltrating information stored on, 


tjames on DSK6SPTVN1PROD with BILLS
23 

HR 3523 RFS

1 processed on, or transiting a system or 

2 network. 

3 ‘‘(B) EXCLUSION.—Such term does not in4 clude the purpose of protecting a system or net5 work from efforts to gain unauthorized access 

6 to such system or network that solely involve 

7 violations of consumer terms of service or con8 sumer licensing agreements and do not other9 wise constitute unauthorized access. 

10 ‘‘(9) CYBERSECURITY SYSTEM.— 

11 ‘‘(A) IN GENERAL.—The term ‘cybersecu12 rity system’ means a system designed or em13 ployed to ensure the integrity, confidentiality, 

14 or availability of, or safeguard, a system or net15 work, including protecting a system or network 

16 from— 

17 ‘‘(i) a vulnerability of a system or net18 work; 

19 ‘‘(ii) a threat to the integrity, con20 fidentiality, or availability of a system or 

21 network or any information stored on, 

22 processed on, or transiting such a system 

23 or network; 


tjames on DSK6SPTVN1PROD with BILLS
24 

HR 3523 RFS

1 ‘‘(iii) efforts to deny access to or de2 grade, disrupt, or destroy a system or net3 work; or 

4 ‘‘(iv) efforts to gain unauthorized ac5 cess to a system or network, including to 

6 gain such unauthorized access for the pur7 pose of exfiltrating information stored on, 

8 processed on, or transiting a system or 

9 network. 

10 ‘‘(B) EXCLUSION.—Such term does not in11 clude a system designed or employed to protect 

12 a system or network from efforts to gain unau13 thorized access to such system or network that 

14 solely involve violations of consumer terms of 

15 service or consumer licensing agreements and 

16 do not otherwise constitute unauthorized access. 

17 ‘‘(10) INTEGRITY.—The term ‘integrity’ means 

18 guarding against improper information modification 

19 or destruction, including ensuring information non20 repudiation and authenticity. 

21 ‘‘(11) PROTECTED ENTITY.—The term ‘pro22 tected entity’ means an entity, other than an indi23 vidual, that contracts with a cybersecurity provider 

24 for goods or services to be used for cybersecurity 

25 purposes. 


tjames on DSK6SPTVN1PROD with BILLS
25 

HR 3523 RFS

1 ‘‘(12) SELF-PROTECTED ENTITY.—The term 

2 ‘self-protected entity’ means an entity, other than an 

3 individual, that provides goods or services for cyber4 security purposes to itself. 

5 ‘‘(13) UTILITY.—The term ‘utility’ means an 

6 entity providing essential services (other than law 

7 enforcement or regulatory services), including elec8 tricity, natural gas, propane, telecommunications, 

9 transportation, water, or wastewater services.’’. 

10 (b) PROCEDURES AND GUIDELINES.—The Director 

11 of National Intelligence shall— 

12 (1) not later than 60 days after the date of the 

13 enactment of this Act, establish procedures under 

14 paragraph (1) of section 1104(a) of the National Se15 curity Act of 1947, as added by subsection (a) of 

16 this section, and issue guidelines under paragraph 

17 (3) of such section 1104(a); 

18 (2) in establishing such procedures and issuing 

19 such guidelines, consult with the Secretary of Home20 land Security to ensure that such procedures and 

21 such guidelines permit the owners and operators of 

22 critical infrastructure to receive all appropriate cyber 

23 threat intelligence (as defined in section 1104(h)(3) 

24 of such Act, as added by subsection (a)) in the pos25 session of the Federal Government; and 


tjames on DSK6SPTVN1PROD with BILLS
26 

HR 3523 RFS

1 (3) following the establishment of such proce2 dures and the issuance of such guidelines, expedi3 tiously distribute such procedures and such guide4 lines to appropriate departments and agencies of the 

5 Federal Government, private-sector entities, and 

6 utilities (as defined in section 1104(h)(9) of such 

7 Act, as added by subsection (a)). 

8 (c) INITIAL REPORT.—The first report required to be 

9 submitted under subsection (e) of section 1104 of the Na10 tional Security Act of 1947, as added by subsection (a) 

11 of this section, shall be submitted not later than 1 year 

12 after the date of the enactment of this Act. 

13 (d) TABLE OF CONTENTS AMENDMENT.—The table 

14 of contents in the first section of the National Security 

15 Act of 1947 is amended by adding at the end the following 

16 new item: 

‘‘Sec. 1104. Cyber threat intelligence and information sharing.’’. 

17 SEC. 3. SUNSET. 

18 Effective on the date that is 5 years after the date 

19 of the enactment of this Act— 

20 (1) section 1104 of the National Security Act of 

21 1947, as added by section 2(a) of this Act, is re22 pealed; and 

23 (2) the table of contents in the first section of 

24 the National Security Act of 1947, as amended by 

25 section 2(d) of this Act, is amended by striking the 


tjames on DSK6SPTVN1PROD with BILLS
27 

HR 3523 RFS

1 item relating to section 1104, as added by such sec2 tion 2(d). 

Passed the House of Representatives April 26, 2012. 

Attest: KAREN L. HAAS, 

Clerk. 


tjames on DSK6SPTVN1PROD with BILLS