```

[House Report 114-756]
[From the U.S. Government Publishing Office]

114th Congress    }                                    {        Report
                        HOUSE OF REPRESENTATIVES
 2d Session       }                                    {       114-756

======================================================================

 
                     CYBER PREPAREDNESS ACT OF 2016

                                _______
                                

 September 19, 2016.--Committed to the Committee of the Whole House on 
            the State of the Union and ordered to be printed

                                _______
                                

  Mr. McCaul, from the Committee on Homeland Security, submitted the 
                               following

                              R E P O R T

                        [To accompany H.R. 5459]

      [Including cost estimate of the Congressional Budget Office]

    The Committee on Homeland Security, to whom was referred 
the bill (H.R. 5459) to amend the Homeland Security Act of 2002 
to enhance preparedness and response capabilities for cyber 
attacks, bolster the dissemination of homeland security 
information related to cyber threats, and for other purposes, 
having considered the same, reports favorably thereon with an 
amendment and recommends that the bill as amended do pass.

                                CONTENTS

                                                                   Page
Purpose and Summary..............................................     3
Background and Need for Legislation..............................     3
Hearings.........................................................     3
Committee Consideration..........................................     3
Committee Votes..................................................     4
Committee Oversight Findings.....................................     4
New Budget Authority, Entitlement Authority, and Tax Expenditures     4
Congressional Budget Office Estimate.............................     5
Statement of General Performance Goals and Objectives............     6
Duplicative Federal Programs.....................................     6
Congressional Earmarks, Limited Tax Benefits, and Limited Tariff 
  Benefits.......................................................     6
Federal Mandates Statement.......................................     6
Preemption Clarification.........................................     6
Disclosure of Directed Rule Makings..............................     6
Advisory Committee Statement.....................................     6
Applicability to Legislative Branch..............................     7
Section-by-Section Analysis of the Legislation...................     7
Changes in Existing Law Made by the Bill, as Reported............     8

    The amendment is as follows:
  Strike all after the enacting clause and insert the 
following:

SECTION 1. SHORT TITLE.

  This Act may be cited as the ``Cyber Preparedness Act of 2016''.

SEC. 2. INFORMATION SHARING.

  Title II of the Homeland Security Act of 2002 is amended--
          (1) in section 210A (6 U.S.C. 124h)--
                  (A) in subsection (b)--
                          (i) in paragraph (10), by inserting before 
                        the semicolon at the end the following: ``, 
                        including, in coordination with the national 
                        cybersecurity and communications integration 
                        center under section 227, accessing timely 
                        technical assistance, risk management support, 
                        and incident response capabilities with respect 
                        to cyber threat indicators, defensive measures, 
                        cybersecurity risks, and incidents (as such 
                        terms are defined in such section), which may 
                        include attribution, mitigation, and 
                        remediation, and the provision of information 
                        and recommendations on security and resilience, 
                        including implications of cybersecurity risks 
                        to equipment and technology related to the 
                        electoral process'';
                          (ii) in paragraph (11), by striking ``and'' 
                        after the semicolon;
                          (iii) by redesignating paragraph (12) as 
                        paragraph (14); and
                          (iv) by inserting after paragraph (11) the 
                        following new paragraphs:
          ``(12) review information relating to cybersecurity risks 
        that is gathered by State, local, and regional fusion centers, 
        and incorporate such information, as appropriate, into the 
        Department's own information relating to cybersecurity risks;
          ``(13) ensure the dissemination to State, local, and regional 
        fusion centers of information relating to cybersecurity risks; 
        and'';
                  (B) in subsection (c)(2)--
                          (i) by redesignating subparagraphs (C) 
                        through (G) as subparagraphs (D) through (H), 
                        respectively; and
                          (ii) by inserting after subparagraph (B) the 
                        following new subparagraph:
                  ``(C) The national cybersecurity and communications 
                integration center under section 227.'';
                  (C) in subsection (d)--
                          (i) in paragraph (3), by striking ``and'' 
                        after the semicolon;
                          (ii) by redesignating paragraph (4) as 
                        paragraph (5); and
                          (iii) by inserting after paragraph (3) the 
                        following new paragraph:
          ``(4) assist, in coordination with the national cybersecurity 
        and communications integration center under section 227, fusion 
        centers in using information relating to cybersecurity risks to 
        develop a comprehensive and accurate threat picture; and''; and
                  (D) in subsection (j)--
                          (i) by redesignating paragraphs (1) through 
                        (5) as paragraphs (2) through (6), 
                        respectively; and
                          (ii) by inserting before paragraph (2), as so 
                        redesignated, the following new paragraph:
          ``(1) the term `cybersecurity risk' has the meaning given 
        that term in section 227;''; and
          (2) in section 227 (6 U.S.C. 148)--
                  (A) in subsection (c)--
                          (i) in paragraph (5)(B), by inserting ``, 
                        including State and major urban area fusion 
                        centers, as appropriate'' before the semicolon 
                        at the end;
                          (ii) in paragraph (7), in the matter 
                        preceding subparagraph (A), by striking 
                        ``information and recommendations'' each place 
                        it appears and inserting ``information, 
                        recommendations, and best practices''; and
                          (iii) in paragraph (9), by inserting ``and 
                        best practices'' after ``defensive measures''; 
                        and
                  (B) in subsection (d)(1)(B)(ii), by inserting ``and 
                State and major urban area fusion centers, as 
                appropriate'' before the semicolon at the end.

SEC. 3. HOMELAND SECURITY GRANTS.

  Subsection (a) of section 2008 of the Homeland Security Act of 2002 
(6 U.S.C. 609) is amended--
          (1) by redesignating paragraphs (4) through (14) as 
        paragraphs (5) through (15), respectively; and
          (2) by inserting after paragraph (3) the following new 
        paragraph:
          ``(4) enhancing cybersecurity, including preparing for and 
        responding to cybersecurity risks and incidents and developing 
        State-wide cyber threat information analysis and dissemination 
        activities;''.

SEC. 4. SENSE OF CONGRESS.

  It is the sense of Congress that to facilitate the timely 
dissemination to appropriate State, local, and private sector 
stakeholders of homeland security information related to cyber threats, 
the Secretary of Homeland Security should, to the greatest extent 
practicable, work to share actionable information related to cyber 
threats in an unclassified form.

                          Purpose and Summary

    The purpose of H.R. 5459 is to amend the Homeland Security 
Act of 2002 to enhance preparedness and response capabilities 
for cyber attacks, bolster the dissemination of homeland 
security information related to cyber threats, and for other 
purposes.

                  Background and Need for Legislation

    Cybersecurity is a major national security issue and the 
threat is real and immediate. For instance, a cyber-attack 
causing widespread power outages could have major cascading 
consequences on public health and safety.
    During a joint hearing of the Subcommittees on Emergency 
Preparedness, Response, and Communications and Cybersecurity, 
Infrastructure Protection, and Security Technologies on May 24, 
2016, Members heard from State officials about their best 
practices and lessons learned in enhancing cybersecurity 
capabilities and how the Federal Government can help mitigate 
some of the challenges States face.
    Among the issues raised by the witnesses was the need for 
better information sharing between the National Cybersecurity 
and Communications Integration Center (NCCIC) and state and 
major urban area fusion centers; the need for clarity on the 
use of homeland security grants to address cybersecurity; and 
the impact the level of classification of cyber threat 
information has on States and fusion centers' ability to share 
that information with relevant stakeholders. This legislation 
seeks to address these concerns.

                                Hearings

    The Committee did not hold any legislative hearings on H.R. 
5459. However, the Subcommittee on Emergency Preparedness, 
Response, and Communications and the Subcommittee on 
Cybersecurity, Infrastructure Protection, and Security 
Technologies held a joint hearing on May 24, 2016, entitled 
``Enhancing Preparedness and Response Capabilities to Address 
Cyber Threats.'' The Subcommittees received testimony from Mr. 
Mark Ghilarducci, Director, Emergency Services, Office of the 
Governor, State of California; Lt. Col. Daniel J. Cooney, 
Assistant Deputy Superintendent, Office of Counter Terrorism, 
New York State Police; Brig. Gen. Steven Spano (Ret.--USAF), 
President and Chief Operating Officer, Center for Internet 
Security; Mr. Mark Raymond, Vice President, National 
Association of State Chief Information Officers; and Mr. Robert 
Galvin, Chief Technology Officer, Port Authority of New York 
and New Jersey.
    The testimony received provided the basis for H.R. 5459.

                        Committee Consideration

    The Committee met on September 13, 2016, to consider H.R. 
5459, and ordered the measure to be reported to the House with 
a favorable recommendation, as amended, by voice vote. The 
Committee took the following actions:
    The following amendments were offered:
 An Amendment in the Nature of a Substitute offered by Mr. 
Donovan (#1); was AGREED TO, as amended, by voice vote.

 An amendment by Mr. Thompson of Mississippi to the Amendment 
in the Nature of a Substitute (#1A); was AGREED TO by voice 
vote.
     Page 1, line 9, insert the following (and make necessary 
conforming changes):
     (i) in paragraph (10), by inserting before the semicolon at the 
end the following:
     ``, including, in coordination with the national cybersecurity and 
communications integration center under section 227, accessing timely 
technical assistance, risk management support, and incident response 
capabilities with respect to cyber threat indicators, defensive 
measures, cybersecurity risks, and incidents (as such terms are defined 
in such section), which may include attribution, mitigation, and 
remediation, and the provision of information and recommendations on 
security and resilience, including implications of cybersecurity risks 
to equipment and technology related to the electoral process''.

 An amendment by Mr. Langevin to the Amendment in the Nature of 
a Substitute (#1B); was AGREED TO by voice vote.
     Page 2, line 6, inset the following (and make necessary conforming 
changes):
     (B) in subsection (c)(2)--
     (i) by redesignating subparagraphs (C) through (G) as 
subparagraphs (D) through (H), respectively; and
     (ii) by inserting after subparagraph (B) the follow new 
subparagraph:
     ``(C) The national cybersecurity and communications integration 
center under section 227.''

 An amendment by Ms. Loretta Sanchez of California to the 
Amendment in the Nature of a Substitute (#1C); was AGREED TO by 
voice vote.
     Page 4, line 8, insert ``and developing State-wide cyber threat 
information analysis and dissemination activities'' after 
``incidents''.

    The Subcommittee on Emergency Preparedness, Response, and 
Communications met on June 16, 2016, to consider H.R. 5459, and 
ordered the measure reported to the Full Committee with a 
favorable recommendation, without amendment, by voice vote.

                            Committee Votes

    Clause 3(b) of Rule XIII of the Rules of the House of 
Representatives requires the Committee to list the recorded 
votes on the motion to report legislation and amendments 
thereto.
    No recorded votes were requested during consideration of 
H.R. 5459.

                      Committee Oversight Findings

    Pursuant to clause 3(c)(1) of Rule XIII of the Rules of the 
House of Representatives, the Committee has held oversight 
hearings and made findings that are reflected in this report.

   New Budget Authority, Entitlement Authority, and Tax Expenditures

    In compliance with clause 3(c)(2) of Rule XIII of the Rules 
of the House of Representatives, the Committee finds that H.R. 
5459, the Cyber Preparedness Act of 2016, would result in no 
new or increased budget authority, entitlement authority, or 
tax expenditures or revenues.

                  Congressional Budget Office Estimate

    The Committee adopts as its own the cost estimate prepared 
by the Director of the Congressional Budget Office pursuant to 
section 402 of the Congressional Budget Act of 1974.

                                     U.S. Congress,
                               Congressional Budget Office,
                                Washington, DC, September 16, 2016.
Hon. Michael McCaul,
Chairman, Committee on Homeland Security,
House of Representatives, Washington, DC.
    Dear Mr. Chairman: The Congressional Budget Office has 
prepared the enclosed cost estimate for H.R. 5459, the Cyber 
Preparedness Act of 2016.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contact is Robert Reese.
            Sincerely,
                                             Mark P. Hadley
                                        (for Keith Hall, Director).
    Enclosure.

H.R. 5459--Cyber Preparedness Act of 2016

    H.R. 5459 would amend the Homeland Security Act of 2002 to 
require the Department of Homeland Security (DHS) to provide 
cybersecurity assistance to, and share cybersecurity risk 
information with, state, local, and regional fusion centers. 
Fusion centers are collaborative efforts among federal, state, 
local, or tribal government agencies that combine resources, 
expertise, or information related to criminal or terrorist 
activity. The bill also would expand membership of the National 
Cybersecurity and Communications Integration Center to include 
state and fusion centers in major urban areas. Under current 
law, DHS currently provides cybersecurity assistance to, and 
shares cybersecurity risk information with, fusion centers; the 
bill would codify those efforts.
    The bill also would authorize recipients of Urban Area 
Initiative or State Homeland Security grants to use those funds 
to enhance cybersecurity at the state, local, or tribal 
government levels. The bill would not alter the number or 
dollar amount of grants provided or the eligibility 
requirements for receiving those grants.
    CBO estimates that implementing H.R. 5459 would have no 
significant effect on the federal budget over the 2017-2021 
period.
    Enacting H.R. 5459 would not affect direct spending or 
revenues; therefore, pay-as-you-go procedures do not apply. CBO 
estimates that enacting H.R. 5459 would not increase net direct 
spending or on-budget deficits in any of the four consecutive 
10-year periods beginning in 2027.
    H.R. 5459 contains no intergovernmental or private-sector 
mandates as defined in the Unfunded Mandates Reform Act. State, 
local, and tribal governments receiving Urban Area Initiative 
or State Homeland Security grants would benefit from the 
ability to use such funds to prepare and respond to 
cybersecurity risks and incidents. Any costs to state, local, 
or tribal governments, including matching contributions, would 
result from complying with conditions of assistance.
    The CBO staff contacts for this estimate are Robert Reese 
and Bill Ma (for federal costs) and Rachel Austin (for 
intergovernmental effects). The estimate was approved by H. 
Samuel Papenfuss, Deputy Assistant Director for Budget 
Analysis.

         Statement of General Performance Goals and Objectives

    Pursuant to clause 3(c)(4) of Rule XIII of the Rules of the 
House of Representatives, H.R. 5459 contains the following 
general performance goals and objectives, including outcome 
related goals and objectives authorized.
    The goal of H.R. 5459 is to enhance preparedness and 
response capabilities for cyber attacks and bolster the sharing 
of information related to cyber threats, to allow cyber 
preparedness activities as an allowable use of State Homeland 
Security Grant Program and the Urban Area Security Initiative 
funding, and to encourage the Department of Homeland Security 
to work on creating tear lines for cyber threat and risk 
information.

                      Duplicative Federal Programs

    Pursuant to clause 3(c) of Rule XIII, the Committee finds 
that H.R. 5459 does not contain any provision that establishes 
or reauthorizes a program known to be duplicative of another 
Federal program.

   Congressional Earmarks, Limited Tax Benefits, and Limited Tariff 
                                Benefits

    In compliance with Rule XXI of the Rules of the House of 
Representatives, this bill, as reported, contains no 
congressional earmarks, limited tax benefits, or limited tariff 
benefits as defined in clause 9(e), 9(f), or 9(g) of the Rule 
XXI.

                       Federal Mandates Statement

    The Committee adopts as its own the estimate of Federal 
mandates prepared by the Director of the Congressional Budget 
Office pursuant to section 423 of the Unfunded Mandates Reform 
Act.

                        Preemption Clarification

    In compliance with section 423 of the Congressional Budget 
Act of 1974, requiring the report of any Committee on a bill or 
joint resolution to include a statement on the extent to which 
the bill or joint resolution is intended to preempt State, 
local, or Tribal law, the Committee finds that H.R. 5459 does 
not preempt any State, local, or Tribal law.

                  Disclosure of Directed Rule Makings

    The Committee estimates that H.R. 5459 would require no 
directed rule makings.

                      Advisory Committee Statement

    No advisory committees within the meaning of section 5(b) 
of the Federal Advisory Committee Act were created by this 
legislation.

                  Applicability to Legislative Branch

    The Committee finds that the legislation does not relate to 
the terms and conditions of employment or access to public 
services or accommodations within the meaning of section 
102(b)(3) of the Congressional Accountability Act.

             Section-by-Section Analysis of the Legislation

Section 1.   Short Title.

    This section provides that this bill may be cited as the 
``Cyber Preparedness Act of 2016''.

Sec. 2.   Information Sharing.

    In an effort to address issues with cyber information 
sharing raised by witnesses at the May 24th joint hearing of 
the Subcommittees on Emergency Preparedness, Response, and 
Communications and Cybersecurity, Infrastructure Protection, 
and Security Technologies, this section seeks to ensure 
information related to cyber risks and threats is shared with 
state and major urban area fusion centers (fusion centers). 
Additionally, this section includes, as a function of the 
NCCIC, sharing information about cyber best practices, in 
addition to the sharing of cyber threat indicators and 
defensive measures currently required by law. Lastly, this 
section authorizes representatives from State and major urban 
area fusion centers to be assigned to the NCCIC, similar to the 
assignment of representatives from information sharing and 
analysis centers (ISACs) permitted under current law and 
permits NCCIC personnel to be deployed to fusion centers.
    The Committee has heard that, while improving, the flow of 
federal cyber threat and risk information to state and local 
emergency services providers is slow and overclassified. The 
current process of sharing information usually causes emergency 
services providers to be reactive rather than proactive in 
addressing the current cyber threats. To date, there are 78 
fusion centers across the Nation with the primary mission to 
serve as the conduit between the Federal Government and States 
and localities for the sharing of intelligence and homeland 
security information. Most fusion centers have developed 
dissemination channels that can be used to ensure cyber threat 
and risk information is getting to the appropriate emergency 
response providers. Additionally, the Committee supports an 
increase in coordination between NCCIC and fusion centers. This 
section will ensure the coordination efforts continue by 
allowing representatives from the National Network of Fusion 
Centers to physically sit at the NCCIC and NCCIC personnel to 
be assigned to fusion centers.
    Lastly, the Committee has learned that many States have 
proactively taken steps to improve their cybersecurity posture. 
These best practices should to be shared in a formal way with 
other States and entities to continue building and enhancing 
the Nation's cybersecurity capabilities.

Sec. 3.   Homeland Security Grants.

    This section authorizes the use of State Homeland Security 
Grant Program (SHSGP) and Urban Area Security Initiative (UASI) 
funds for cybersecurity enhancements. While States and urban 
areas are currently permitted to use SHSGP and UASI funds to 
increase their cybersecurity posture, this section will codify 
that cyber preparedness activities are allowable uses for both 
grant programs. For several years now, FEMA has released an 
annual National Preparedness Report, which highlights the 
States' 32 preparedness core capabilities, as defined by the 
National Preparedness Goal. Since the first National 
Preparedness Report was released in 2012, States have ranked 
their cybersecurity capabilities as one of their lowest. The 
Committee believes the ability for States and urban areas to 
use SHSGP and UASI funds for cyber preparedness is essential 
and this section will ensure that SHSGP and USAI funds remain 
available for cyber preparedness.

Sec. 4.   Sense of Congress.

    This section expresses the sense of Congress that the 
Department of Homeland Security should, to the greatest extent 
practicable, work to establish tear lines so actionable 
intelligence related to cyber threats may be shared with those 
without clearances. The Committee has heard from emergency 
response providers, time and time again, that cyber threat 
information is overclassified which prohibits their ability to 
receive and disseminate cyber threat information. The majority 
of emergency response providers are not cleared to the TS//SCI 
or even the Top Secret level. The Committee believes the 
Department should work on establishing tear lines to ensure 
valuable cyber threat information is disseminated to all 
appropriate stakeholders.

         Changes in Existing Law Made by the Bill, as Reported

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italics, and existing law in which no 
change is proposed is shown in roman):

HOMELAND SECURITY ACT OF 2002

           *       *       *       *       *       *       *

TITLE II--INFORMATION ANALYSIS AND INFRASTRUCTURE PROTECTION

           *       *       *       *       *       *       *

  Subtitle A--Information and Analysis and Infrastructure Protection; 
Access to Information

           *       *       *       *       *       *       *

SEC. 210A. DEPARTMENT OF HOMELAND SECURITY STATE, LOCAL, AND REGIONAL 
                    FUSION CENTER INITIATIVE.

  (a) Establishment.--The Secretary, in consultation with the 
program manager of the information sharing environment 
established under section 1016 of the Intelligence Reform and 
Terrorism Prevention Act of 2004 (6 U.S.C. 485), the Attorney 
General, the Privacy Officer of the Department, the Officer for 
Civil Rights and Civil Liberties of the Department, and the 
Privacy and Civil Liberties Oversight Board established under 
section 1061 of the Intelligence Reform and Terrorism 
Prevention Act of 2004 (5 U.S.C. 601 note), shall establish a 
Department of Homeland Security State, Local, and Regional 
Fusion Center Initiative to establish partnerships with State, 
local, and regional fusion centers.
  (b) Department Support and Coordination.--Through the 
Department of Homeland Security State, Local, and Regional 
Fusion Center Initiative, and in coordination with the 
principal officials of participating State, local, or regional 
fusion centers and the officers designated as the Homeland 
Security Advisors of the States, the Secretary shall--
          (1) provide operational and intelligence advice and 
        assistance to State, local, and regional fusion 
        centers;
          (2) support efforts to include State, local, and 
        regional fusion centers into efforts to establish an 
        information sharing environment;
          (3) conduct tabletop and live training exercises to 
        regularly assess the capability of individual and 
        regional networks of State, local, and regional fusion 
        centers to integrate the efforts of such networks with 
        the efforts of the Department;
          (4) coordinate with other relevant Federal entities 
        engaged in homeland security-related activities;
          (5) provide analytic and reporting advice and 
        assistance to State, local, and regional fusion 
        centers;
          (6) review information within the scope of the 
        information sharing environment, including homeland 
        security information, terrorism information, and 
        weapons of mass destruction information, that is 
        gathered by State, local, and regional fusion centers, 
        and to incorporate such information, as appropriate, 
        into the Department's own such information;
          (7) provide management assistance to State, local, 
        and regional fusion centers;
          (8) serve as a point of contact to ensure the 
        dissemination of information within the scope of the 
        information sharing environment, including homeland 
        security information, terrorism information, and 
        weapons of mass destruction information;
          (9) facilitate close communication and coordination 
        between State, local, and regional fusion centers and 
        the Department;
          (10) provide State, local, and regional fusion 
        centers with expertise on Department resources and 
        operations, including, in coordination with the 
        national cybersecurity and communications integration 
        center under section 227, accessing timely technical 
        assistance, risk management support, and incident 
        response capabilities with respect to cyber threat 
        indicators, defensive measures, cybersecurity risks, 
        and incidents (as such terms are defined in such 
        section), which may include attribution, mitigation, 
        and remediation, and the provision of information and 
        recommendations on security and resilience, including 
        implications of cybersecurity risks to equipment and 
        technology related to the electoral process;
          (11) provide training to State, local, and regional 
        fusion centers and encourage such fusion centers to 
        participate in terrorism threat-related exercises 
        conducted by the Department; [and]
          (12) review information relating to cybersecurity 
        risks that is gathered by State, local, and regional 
        fusion centers, and incorporate such information, as 
        appropriate, into the Department's own information 
        relating to cybersecurity risks;
          (13) ensure the dissemination to State, local, and 
        regional fusion centers of information relating to 
        cybersecurity risks; and
          [(12)] (14) carry out such other duties as the 
        Secretary determines are appropriate.
  (c) Personnel Assignment.--
          (1) In general.--The Under Secretary for Intelligence 
        and Analysis shall, to the maximum extent practicable, 
        assign officers and intelligence analysts from 
        components of the Department to participating State, 
        local, and regional fusion centers.
          (2) Personnel sources.--Officers and intelligence 
        analysts assigned to participating fusion centers under 
        this subsection may be assigned from the following 
        Department components, in coordination with the 
        respective component head and in consultation with the 
        principal officials of participating fusion centers:
                  (A) Office of Intelligence and Analysis.
                  (B) Office of Infrastructure Protection.
                  (C) The national cybersecurity and 
                communications integration center under section 
                227.
                  [(C)] (D) Transportation Security 
                Administration.
                  [(D)] (E) United States Customs and Border 
                Protection.
                  [(E)] (F) United States Immigration and 
                Customs Enforcement.
                  [(F)] (G) United States Coast Guard.
                  [(G)] (H) Other components of the Department, 
                as determined by the Secretary.
          (3) Qualifying criteria.--
                  (A) In general.--The Secretary shall develop 
                qualifying criteria for a fusion center to 
                participate in the assigning of Department 
                officers or intelligence analysts under this 
                section.
                  (B) Criteria.--Any criteria developed under 
                subparagraph (A) may include--
                          (i) whether the fusion center, 
                        through its mission and governance 
                        structure, focuses on a broad 
                        counterterrorism approach, and whether 
                        that broad approach is pervasive 
                        through all levels of the organization;
                          (ii) whether the fusion center has 
                        sufficient numbers of adequately 
                        trained personnel to support a broad 
                        counterterrorism mission;
                          (iii) whether the fusion center has--
                                  (I) access to relevant law 
                                enforcement, emergency 
                                response, private sector, open 
                                source, and national security 
                                data; and
                                  (II) the ability to share and 
                                analytically utilize that data 
                                for lawful purposes;
                          (iv) whether the fusion center is 
                        adequately funded by the State, local, 
                        or regional government to support its 
                        counterterrorism mission; and
                          (v) the relevancy of the mission of 
                        the fusion center to the particular 
                        source component of Department officers 
                        or intelligence analysts.
          (4) Prerequisite.--
                  (A) Intelligence analysis, privacy, and civil 
                liberties training.--Before being assigned to a 
                fusion center under this section, an officer or 
                intelligence analyst shall undergo--
                          (i) appropriate intelligence analysis 
                        or information sharing training using 
                        an intelligence-led policing curriculum 
                        that is consistent with--
                                  (I) standard training and 
                                education programs offered to 
                                Department law enforcement and 
                                intelligence personnel; and
                                  (II) the Criminal 
                                Intelligence Systems Operating 
                                Policies under part 23 of title 
                                28, Code of Federal Regulations 
                                (or any corresponding similar 
                                rule or regulation);
                          (ii) appropriate privacy and civil 
                        liberties training that is developed, 
                        supported, or sponsored by the Privacy 
                        Officer appointed under section 222 and 
                        the Officer for Civil Rights and Civil 
                        Liberties of the Department, in 
                        consultation with the Privacy and Civil 
                        Liberties Oversight Board established 
                        under section 1061 of the Intelligence 
                        Reform and Terrorism Prevention Act of 
                        2004 (5 U.S.C. 601 note); and
                          (iii) such other training prescribed 
                        by the Under Secretary for Intelligence 
                        and Analysis.
                  (B) Prior work experience in area.--In 
                determining the eligibility of an officer or 
                intelligence analyst to be assigned to a fusion 
                center under this section, the Under Secretary 
                for Intelligence and Analysis shall consider 
                the familiarity of the officer or intelligence 
                analyst with the State, locality, or region, as 
                determined by such factors as whether the 
                officer or intelligence analyst--
                          (i) has been previously assigned in 
                        the geographic area; or
                          (ii) has previously worked with 
                        intelligence officials or law 
                        enforcement or other emergency response 
                        providers from that State, locality, or 
                        region.
          (5) Expedited security clearance processing.--The 
        Under Secretary for Intelligence and Analysis--
                  (A) shall ensure that each officer or 
                intelligence analyst assigned to a fusion 
                center under this section has the appropriate 
                security clearance to contribute effectively to 
                the mission of the fusion center; and
                  (B) may request that security clearance 
                processing be expedited for each such officer 
                or intelligence analyst and may use available 
                funds for such purpose.
          (6) Further qualifications.--Each officer or 
        intelligence analyst assigned to a fusion center under 
        this section shall satisfy any other qualifications the 
        Under Secretary for Intelligence and Analysis may 
        prescribe.
  (d) Responsibilities.--An officer or intelligence analyst 
assigned to a fusion center under this section shall--
          (1) assist law enforcement agencies and other 
        emergency response providers of State, local, and 
        tribal governments and fusion center personnel in using 
        information within the scope of the information sharing 
        environment, including homeland security information, 
        terrorism information, and weapons of mass destruction 
        information, to develop a comprehensive and accurate 
        threat picture;
          (2) review homeland security-relevant information 
        from law enforcement agencies and other emergency 
        response providers of State, local, and tribal 
        government;
          (3) create intelligence and other information 
        products derived from such information and other 
        homeland security-relevant information provided by the 
        Department; [and]
          (4) assist, in coordination with the national 
        cybersecurity and communications integration center 
        under section 227, fusion centers in using information 
        relating to cybersecurity risks to develop a 
        comprehensive and accurate threat picture; and
          [(4)] (5) assist in the dissemination of such 
        products, as coordinated by the Under Secretary for 
        Intelligence and Analysis, to law enforcement agencies 
        and other emergency response providers of State, local, 
        and tribal government, other fusion centers, and 
        appropriate Federal agencies.
  (e) Border Intelligence Priority.--
          (1) In general.--The Secretary shall make it a 
        priority to assign officers and intelligence analysts 
        under this section from United States Customs and 
        Border Protection, United States Immigration and 
        Customs Enforcement, and the Coast Guard to 
        participating State, local, and regional fusion centers 
        located in jurisdictions along land or maritime borders 
        of the United States in order to enhance the integrity 
        of and security at such borders by helping Federal, 
        State, local, and tribal law enforcement authorities to 
        identify, investigate, and otherwise interdict persons, 
        weapons, and related contraband that pose a threat to 
        homeland security.
          (2) Border intelligence products.--When performing 
        the responsibilities described in subsection (d), 
        officers and intelligence analysts assigned to 
        participating State, local, and regional fusion centers 
        under this section shall have, as a primary 
        responsibility, the creation of border intelligence 
        products that--
                  (A) assist State, local, and tribal law 
                enforcement agencies in deploying their 
                resources most efficiently to help detect and 
                interdict terrorists, weapons of mass 
                destruction, and related contraband at land or 
                maritime borders of the United States;
                  (B) promote more consistent and timely 
                sharing of border security-relevant information 
                among jurisdictions along land or maritime 
                borders of the United States; and
                  (C) enhance the Department's situational 
                awareness of the threat of acts of terrorism at 
                or involving the land or maritime borders of 
                the United States.
  (f) Database Access.--In order to fulfill the objectives 
described under subsection (d), each officer or intelligence 
analyst assigned to a fusion center under this section shall 
have appropriate access to all relevant Federal databases and 
information systems, consistent with any policies, guidelines, 
procedures, instructions, or standards established by the 
President or, as appropriate, the program manager of the 
information sharing environment for the implementation and 
management of that environment.
  (g) Consumer Feedback.--
          (1) In general.--The Secretary shall create a 
        voluntary mechanism for any State, local, or tribal law 
        enforcement officer or other emergency response 
        provider who is a consumer of the intelligence or other 
        information products referred to in subsection (d) to 
        provide feedback to the Department on the quality and 
        utility of such intelligence products.
          (2) Report.--Not later than one year after the date 
        of the enactment of the Implementing Recommendations of 
        the 9/11 Commission Act of 2007, and annually 
        thereafter, the Secretary shall submit to the Committee 
        on Homeland Security and Governmental Affairs of the 
        Senate and the Committee on Homeland Security of the 
        House of Representatives a report that includes a 
        description of the consumer feedback obtained under 
        paragraph (1) and, if applicable, how the Department 
        has adjusted its production of intelligence products in 
        response to that consumer feedback.
  (h) Rule of Construction.--
          (1) In general.--The authorities granted under this 
        section shall supplement the authorities granted under 
        section 201(d) and nothing in this section shall be 
        construed to abrogate the authorities granted under 
        section 201(d).
          (2) Participation.--Nothing in this section shall be 
        construed to require a State, local, or regional 
        government or entity to accept the assignment of 
        officers or intelligence analysts of the Department 
        into the fusion center of that State, locality, or 
        region.
  (i) Guidelines.--The Secretary, in consultation with the 
Attorney General, shall establish guidelines for fusion centers 
created and operated by State and local governments, to include 
standards that any such fusion center shall--
          (1) collaboratively develop a mission statement, 
        identify expectations and goals, measure performance, 
        and determine effectiveness for that fusion center;
          (2) create a representative governance structure that 
        includes law enforcement officers and other emergency 
        response providers and, as appropriate, the private 
        sector;
          (3) create a collaborative environment for the 
        sharing of intelligence and information among Federal, 
        State, local, and tribal government agencies (including 
        law enforcement officers and other emergency response 
        providers), the private sector, and the public, 
        consistent with any policies, guidelines, procedures, 
        instructions, or standards established by the President 
        or, as appropriate, the program manager of the 
        information sharing environment;
          (4) leverage the databases, systems, and networks 
        available from public and private sector entities, in 
        accordance with all applicable laws, to maximize 
        information sharing;
          (5) develop, publish, and adhere to a privacy and 
        civil liberties policy consistent with Federal, State, 
        and local law;
          (6) provide, in coordination with the Privacy Officer 
        of the Department and the Officer for Civil Rights and 
        Civil Liberties of the Department, appropriate privacy 
        and civil liberties training for all State, local, 
        tribal, and private sector representatives at the 
        fusion center;
          (7) ensure appropriate security measures are in place 
        for the facility, data, and personnel;
          (8) select and train personnel based on the needs, 
        mission, goals, and functions of that fusion center;
          (9) offer a variety of intelligence and information 
        services and products to recipients of fusion center 
        intelligence and information; and
          (10) incorporate law enforcement officers, other 
        emergency response providers, and, as appropriate, the 
        private sector, into all relevant phases of the 
        intelligence and fusion process, consistent with the 
        mission statement developed under paragraph (1), either 
        through full time representatives or liaison 
        relationships with the fusion center to enable the 
        receipt and sharing of information and intelligence.
  (j) Definitions.--In this section--
          (1) the term ``cybersecurity risk'' has the meaning 
        given that term in section 227;
          [(1)] (2) the term ``fusion center'' means a 
        collaborative effort of 2 or more Federal, State, 
        local, or tribal government agencies that combines 
        resources, expertise, or information with the goal of 
        maximizing the ability of such agencies to detect, 
        prevent, investigate, apprehend, and respond to 
        criminal or terrorist activity;
          [(2)] (3) the term ``information sharing 
        environment'' means the information sharing environment 
        established under section 1016 of the Intelligence 
        Reform and Terrorism Prevention Act of 2004 (6 U.S.C. 
        485);
          [(3)] (4) the term ``intelligence analyst'' means an 
        individual who regularly advises, administers, 
        supervises, or performs work in the collection, 
        gathering, analysis, evaluation, reporting, production, 
        or dissemination of information on political, economic, 
        social, cultural, physical, geographical, scientific, 
        or military conditions, trends, or forces in foreign or 
        domestic areas that directly or indirectly affect 
        national security;
          [(4)] (5) the term ``intelligence-led policing'' 
        means the collection and analysis of information to 
        produce an intelligence end product designed to inform 
        law enforcement decision making at the tactical and 
        strategic levels; and
          [(5)] (6) the term ``terrorism information'' has the 
        meaning given that term in section 1016 of the 
        Intelligence Reform and Terrorism Prevention Act of 
        2004 (6 U.S.C. 485).
  (k) Authorization of Appropriations.--There is authorized to 
be appropriated $10,000,000 for each of fiscal years 2008 
through 2012, to carry out this section, except for subsection 
(i), including for hiring officers and intelligence analysts to 
replace officers and intelligence analysts who are assigned to 
fusion centers under this section.

           *       *       *       *       *       *       *

Subtitle C--Information Security

           *       *       *       *       *       *       *

SEC. 227. NATIONAL CYBERSECURITY AND COMMUNICATIONS INTEGRATION CENTER.

  (a) Definitions.--In this section--
          (1) the term ``cybersecurity risk''--
                  (A) means threats to and vulnerabilities of 
                information or information systems and any 
                related consequences caused by or resulting 
                from unauthorized access, use, disclosure, 
                degradation, disruption, modification, or 
                destruction of such information or information 
                systems, including such related consequences 
                caused by an act of terrorism; and
                  (B) does not include any action that solely 
                involves a violation of a consumer term of 
                service or a consumer licensing agreement;
          (2) the terms ``cyber threat indicator'' and 
        ``defensive measure'' have the meanings given those 
        terms in section 102 of the Cybersecurity Act of 2015;
          (3) the term ``incident'' means an occurrence that 
        actually or imminently jeopardizes, without lawful 
        authority, the integrity, confidentiality, or 
        availability of information on an information system, 
        or actually or imminently jeopardizes, without lawful 
        authority, an information system;
          (4) the term ``information sharing and analysis 
        organization'' has the meaning given that term in 
        section 212(5);
          (5) the term ``information system'' has the meaning 
        given that term in section 3502(8) of title 44, United 
        States Code; and
          (6) the term ``sharing'' (including all conjugations 
        thereof) means providing, receiving, and disseminating 
        (including all conjugations of each of such terms).
  (b) Center.--There is in the Department a national 
cybersecurity and communications integration center (referred 
to in this section as the ``Center'') to carry out certain 
responsibilities of the Under Secretary appointed under section 
103(a)(1)(H).
  (c) Functions.--The cybersecurity functions of the Center 
shall include--
          (1) being a Federal civilian interface for the multi-
        directional and cross-sector sharing of information 
        related to cyber threat indicators, defensivemeasures, 
        cybersecurity risks, incidents, analysis, and warnings 
        for Federal and non-Federal entities, including the 
        implementationof title I of the Cybersecurity Act of 
        2015;
          (2) providing shared situational awareness to enable 
        real-time, integrated, and operational actions across 
        the Federal Government and non-Federal entities to 
        address cybersecurity risks and incidents to Federal 
        and non-Federal entities;
          (3) coordinating the sharing of information related 
        to cyber threat indicators, defensive 
        measures,cybersecurity risks, and incidents across the 
        Federal Government;
          (4) facilitating cross-sector coordination to address 
        cybersecurity risks and incidents, including 
        cybersecurity risks and incidents that may be related 
        or could have consequential impacts across multiple 
        sectors;
          (5)(A) conducting integration and analysis, including 
        cross-sector integration and analysis, of cyber threat 
        indicators, defensivemeasures, cybersecurity risks, and 
        incidents; and
          (B) sharing the analysis conducted under subparagraph 
        (A) with Federal and non-Federal entities, including 
        State and major urban area fusion centers, as 
        appropriate;
          (6) upon request, providing timely technical 
        assistance, risk management support, and incident 
        response capabilities to Federal and non-Federal 
        entities with respect to cyber threat indicators, 
        defensive measures, cybersecurityrisks, and incidents, 
        which may include attribution, mitigation, and 
        remediation;
          (7) providing [information and recommendations] 
        information, recommendations, and best practices on 
        security and resilience measures to Federal and non-
        Federal entities, including [information and 
        recommendations] information, recommendations, and best 
        practices to--
                  (A) facilitate information security;
                  (B) strengthen information systems against 
                cybersecurity risks and incidents; and
                  (C) sharing cyber threat indicators and 
                defensive measures;
          (8) engaging with international partners, in 
        consultation with other appropriate agencies, to--
                  (A) collaborate on cyber threat indicators, 
                defensive measures, and information related to 
                cybersecurity risks and incidents; and
                  (B) enhance the security and resilience of 
                global cybersecurity;
          (9) sharing cyber threat indicators, defensive 
        measures and best practices, and other information 
        related to cybersecurity risks and incidents with 
        Federal and non-Federal entities, including across 
        sectors of critical infrastructure and with State and 
        major urban area fusion centers, as appropriate;
          (10) participating, as appropriate, in national 
        exercises run by the Department; and
          (11) in coordination with the Office of Emergency 
        Communications of the Department, assessing and 
        evaluating consequence, vulnerability, and threat 
        information regarding cyber incidents to public safety 
        communications to help facilitate continuous 
        improvements to the security and resiliency of such 
        communications.
  (d) Composition.--
          (1) In general.--The Center shall be composed of--
                  (A) appropriate representatives of Federal 
                entities, such as--
                          (i) sector-specific agencies;
                          (ii) civilian and law enforcement 
                        agencies; and
                          (iii) elements of the intelligence 
                        community, as that term is defined 
                        under section 3(4) of the National 
                        Security Act of 1947 (50 U.S.C. 
                        3003(4));
                  (B) appropriate representatives of non-
                Federal entities, such as--
                          (i) State, local, and tribal 
                        governments;
                          (ii) information sharing and analysis 
                        organizations, including information 
                        sharing and analysis centers and State 
                        and major urban area fusion centers, as 
                        appropriate;
                          (iii) owners and operators of 
                        critical information systems; and
                          (iv) private entities;
                  (C) components within the Center that carry 
                out cybersecurity and communications 
                activities;
                  (D) a designated Federal official for 
                operational coordination with and across each 
                sector;
                  (E) an entity that collaborates with State 
                and local governments on cybersecurity risks 
                and incidents, and has entered into a voluntary 
                information sharing relationship with the 
                Center; and
                  (F) other appropriate representatives or 
                entities, as determined by the Secretary.
          (2) Incidents.--In the event of an incident, during 
        exigent circumstances the Secretary may grant a Federal 
        or non-Federal entity immediate temporary access to the 
        Center.
  (e) Principles.--In carrying out the functions under 
subsection (c), the Center shall ensure--
          (1) to the extent practicable, that--
                  (A) timely, actionable, and relevant cyber 
                threatindicators, defensive measures, and 
                information related to cybersecurity risks, 
                incidents, and analysis is shared;
                  (B) when appropriate, cyber threatindicators, 
                defensive measures, and information related to 
                cybersecurity risks, incidents, and analysis is 
                integrated with other relevant information and 
                tailored to the specific characteristics of a 
                sector;
                  (C) activities are prioritized and conducted 
                based on the level of risk;
                  (D) industry sector-specific, academic, and 
                national laboratory expertise is sought and 
                receives appropriate consideration;
                  (E) continuous, collaborative, and inclusive 
                coordination occurs--
                          (i) across sectors; and
                          (ii) with--
                                  (I) sector coordinating 
                                councils;
                                  (II) information sharing and 
                                analysis organizations; and
                                  (III) other appropriate non-
                                Federal partners;
                  (F) as appropriate, the Center works to 
                develop and use mechanisms for sharing 
                information related to cyber threat indicators, 
                defensive measures,cybersecurity risks, and 
                incidents that are technology-neutral, 
                interoperable, real-time, cost-effective, and 
                resilient;
                  (G) the Center works with other agencies to 
                reduce unnecessarily duplicative sharing of 
                information related to cyber threat 
                indicators,defensive measures, cybersecurity 
                risks, andincidents; and;
                  (H) the Center designates an agency contact 
                for non-Federal entities;
          (2) that information related to cyber threat 
        indicators, defensive measures, cybersecurityrisks, and 
        incidents is appropriately safeguarded against 
        unauthorized access or disclosure; and
          (3) that activities conducted by the Center comply 
        with all policies, regulations, and laws that protect 
        the privacy and civil liberties of United States 
        persons, including by working withthe Privacy Officer 
        appointed under section 222 to ensurethat the Center 
        follows the policies and procedures specifiedin 
        subsections (b) and (d)(5)(C) of section 105 of the 
        CybersecurityAct of 2015.
  (f) No Right or Benefit.--
          (1) In general.--The provision of assistance or 
        information to, and inclusion in the Center of, 
        governmental or private entities under this section 
        shall be at the sole and unreviewable discretion of the 
        Under Secretary appointed under section 103(a)(1)(H).
          (2) Certain assistance or information.--The provision 
        of certain assistance or information to, or inclusion 
        in the Center of, one governmental or private entity 
        pursuant to this section shall not create a right or 
        benefit, substantive or procedural, to similar 
        assistance or information for any other governmental or 
        private entity.
  (g) Automated Information Sharing.--
          (1) In general.--The Under Secretary appointed under 
        section 103(a)(1)(H), in coordination with industry and 
        other stakeholders, shall develop capabilities making 
        use of existing information technology industry 
        standards and best practices, as appropriate, that 
        support and rapidly advance the development, adoption, 
        and implementation of automated mechanisms for the 
        sharing of cyber threat indicators and defensive 
        measures in accordance with title I of the 
        Cybersecurity Act of 2015.
          (2) Annual report.--The Under Secretary appointed 
        under section 103(a)(1)(H) shall submit to the 
        Committee on Homeland Security and Governmental Affairs 
        of the Senate and the Committee on Homeland Security of 
        the House of Representatives an annual report on the 
        status and progress of the development of the 
        capabilities described in paragraph (1). Such reports 
        shall be required until such capabilities are fully 
        implemented.
  (h) Voluntary Information Sharing Procedures.--
          (1) Procedures.--
                  (A) In general.--The Center may enter into a 
                voluntary information sharing relationship with 
                any consenting non-Federal entity for the 
                sharing of cyber threat indicators and 
                defensive measures for cybersecurity purposes 
                in accordance with this section. Nothing in 
                this subsection may be construed to require any 
                non-Federal entity to enter into any such 
                information sharing relationship with the 
                Center or any other entity. The Center may 
                terminate a voluntary information sharing 
                relationship under this subsection, at the sole 
                and unreviewable discretion of the Secretary, 
                acting through the Under Secretary appointed 
                under section 103(a)(1)(H), for any reason, 
                including if the Center determines that the 
                non-Federal entity with which the Center has 
                entered into such a relationship has violated 
                the terms of this subsection.
                  (B) National security.--The Secretary may 
                decline to enter into a voluntary information 
                sharing relationship under this subsection, at 
                the sole and unreviewable discretion of the 
                Secretary, acting through the Under Secretary 
                appointed under section 103(a)(1)(H), for any 
                reason, including if the Secretary determines 
                that such is appropriate for national security.
          (2) Voluntary information sharing relationships.--A 
        voluntary information sharing relationship under this 
        subsection may be characterized as an agreement 
        described in this paragraph.
                  (A) Standard agreement.--For the use of a 
                non-Federal entity, the Center shall make 
                available a standard agreement, consistent with 
                this section, on the Department's website.
                  (B) Negotiated agreement.--At the request of 
                a non-Federal entity, and if determined 
                appropriate by the Center, at the sole and 
                unreviewable discretion of the Secretary, 
                acting through the Under Secretary appointed 
                under section 103(a)(1)(H), the Department 
                shall negotiate a non-standard agreement, 
                consistent with this section.
                  (C) Existing agreements.--An agreement 
                between the Center and a non-Federal entity 
                that is entered into before the date of 
                enactment of this subsection, or such an 
                agreement that is in effect before such date, 
                shall be deemed in compliance with the 
                requirements of this subsection, 
                notwithstanding any other provision or 
                requirement of this subsection. An agreement 
                under this subsection shall include the 
                relevant privacy protections as in effect under 
                the Cooperative Research and Development 
                Agreement for Cybersecurity Information Sharing 
                and Collaboration, as of December 31, 2014. 
                Nothing in this subsection may be construed to 
                require a non-Federal entity to enter into 
                either a standard or negotiated agreement to be 
                in compliance with this subsection.
  (i) Direct Reporting.--The Secretary shall develop policies 
and procedures for direct reporting to the Secretary by the 
Director of the Center regarding significant cybersecurity 
risks and incidents.
  (j) Reports on International Cooperation.--Not later than 180 
days after the date of enactment of this subsection, and 
periodically thereafter, the Secretary of Homeland Security 
shall submit to the Committee on Homeland Security and 
Governmental Affairs of the Senate and the Committee on 
Homeland Security of the House of Representatives a report on 
the range of efforts underway to bolster cybersecurity 
collaboration with relevant international partners in 
accordance with subsection (c)(8).
  (k) Outreach.--Not later than 60 days after the date of 
enactment of this subsection, the Secretary, acting through the 
Under Secretary appointed under section 103(a)(1)(H), shall--
          (1) disseminate to the public information about how 
        to voluntarily share cyber threat indicators and 
        defensive measures with the Center; and
          (2) enhance outreach to critical infrastructure 
        owners and operators for purposes of such sharing.
  (l) Coordinated Vulnerability Disclosure.--The Secretary, in 
coordination with industry and other stakeholders, may develop 
and adhere to Department policies and procedures for 
coordinating vulnerability disclosures.

           *       *       *       *       *       *       *

TITLE XX--HOMELAND SECURITY GRANTS

           *       *       *       *       *       *       *

Subtitle A--Grants to States and High-Risk Urban Areas

           *       *       *       *       *       *       *

SEC. 2008. USE OF FUNDS.

  (a) Permitted Uses.--The Administrator shall permit the 
recipient of a grant under section 2003 or 2004 to use grant 
funds to achieve target capabilities related to preventing, 
preparing for, protecting against, and responding to acts of 
terrorism, consistent with a State homeland security plan and 
relevant local, tribal, and regional homeland security plans, 
including by working in conjunction with a National Laboratory 
(as defined in section 2(3) of the Energy Policy Act of 2005 
(42 U.S.C. 15801(3))), through--
          (1) developing and enhancing homeland security, 
        emergency management, or other relevant plans, 
        assessments, or mutual aid agreements;
          (2) designing, conducting, and evaluating training 
        and exercises, including training and exercises 
        conducted under section 512 of this Act and section 648 
        of the Post-Katrina Emergency Management Reform Act of 
        2006 (6 U.S.C. 748);
          (3) protecting a system or asset included on the 
        prioritized critical infrastructure list established 
        under section 210E(a)(2);
          (4) enhancing cybersecurity, including preparing for 
        and responding to cybersecurity risks and incidents and 
        developing State-wide cyber threat information analysis 
        and dissemination activities;
          [(4)] (5) purchasing, upgrading, storing, or 
        maintaining equipment, including computer hardware and 
        software;
          [(5)] (6) ensuring operability and achieving 
        interoperability of emergency communications;
          [(6)] (7) responding to an increase in the threat 
        level under the Homeland Security Advisory System, or 
        to the needs resulting from a National Special Security 
        Event;
          [(7)] (8) establishing, enhancing, and staffing with 
        appropriately qualified personnel State, local, and 
        regional fusion centers that comply with the guidelines 
        established under section 210A(i);
          [(8)] (9) enhancing school preparedness;
          [(9)] (10) enhancing the security and preparedness of 
        secure and nonsecure areas of eligible airports and 
        surface transportation systems;
          [(10)] (11) supporting public safety answering 
        points;
          [(11)] (12) paying salaries and benefits for 
        personnel, including individuals employed by the grant 
        recipient on the date of the relevant grant 
        application, to serve as qualified intelligence 
        analysts, regardless of whether such analysts are 
        current or new full-time employees or contract 
        employees;
          [(12)] (13) paying expenses directly related to 
        administration of the grant, except that such expenses 
        may not exceed 3 percent of the amount of the grant;
          [(13)] (14) any activity permitted under the Fiscal 
        Year 2007 Program Guidance of the Department for the 
        State Homeland Security Grant Program, the Urban Area 
        Security Initiative (including activities permitted 
        under the full-time counterterrorism staffing pilot), 
        or the Law Enforcement Terrorism Prevention Program; 
        and
          [(14)] (15) any other appropriate activity, as 
        determined by the Administrator.
  (b) Limitations on Use of Funds.--
          (1) In general.--Funds provided under section 2003 or 
        2004 may not be used--
                  (A) to supplant State or local funds, except 
                that nothing in this paragraph shall prohibit 
                the use of grant funds provided to a State or 
                high-risk urban area for otherwise permissible 
                uses under subsection (a) on the basis that a 
                State or high-risk urban area has previously 
                used State or local funds to support the same 
                or similar uses; or
                  (B) for any State or local government cost-
                sharing contribution.
          (2) Personnel.--
                  (A) In general.--Not more than 50 percent of 
                the amount awarded to a grant recipient under 
                section 2003 or 2004 in any fiscal year may be 
                used to pay for personnel, including overtime 
                and backfill costs, in support of the permitted 
                uses under subsection (a).
                  (B) Waiver.--At the request of the recipient 
                of a grant under section 2003 or 2004, the 
                Administrator may grant a waiver of the 
                limitation under subparagraph (A).
          (3) Limitations on discretion.--
                  (A) In general.--With respect to the use of 
                amounts awarded to a grant recipient under 
                section 2003 or 2004 for personnel costs in 
                accordance with paragraph (2) of this 
                subsection, the Administrator may not--
                          (i) impose a limit on the amount of 
                        the award that may be used to pay for 
                        personnel, or personnel-related, costs 
                        that is higher or lower than the 
                        percent limit imposed in paragraph 
                        (2)(A); or
                          (ii) impose any additional limitation 
                        on the portion of the funds of a 
                        recipient that may be used for a 
                        specific type, purpose, or category of 
                        personnel, or personnel-related, costs.
                  (B) Analysts.--If amounts awarded to a grant 
                recipient under section 2003 or 2004 are used 
                for paying salary or benefits of a qualified 
                intelligence analyst under subsection (a)(10), 
                the Administrator shall make such amounts 
                available without time limitations placed on 
                the period of time that the analyst can serve 
                under the grant.
          (4) Construction.--
                  (A) In general.--A grant awarded under 
                section 2003 or 2004 may not be used to acquire 
                land or to construct buildings or other 
                physical facilities.
                  (B) Exceptions.--
                          (i) In general.--Notwithstanding 
                        subparagraph (A), nothing in this 
                        paragraph shall prohibit the use of a 
                        grant awarded under section 2003 or 
                        2004 to achieve target capabilities 
                        related to preventing, preparing for, 
                        protecting against, or responding to 
                        acts of terrorism, including through 
                        the alteration or remodeling of 
                        existing buildings for the purpose of 
                        making such buildings secure against 
                        acts of terrorism.
                          (ii) Requirements for exception.--No 
                        grant awarded under section 2003 or 
                        2004 may be used for a purpose 
                        described in clause (i) unless--
                                  (I) specifically approved by 
                                the Administrator;
                                  (II) any construction work 
                                occurs under terms and 
                                conditions consistent with the 
                                requirements under section 
                                611(j)(9) of the Robert T. 
                                Stafford Disaster Relief and 
                                Emergency Assistance Act (42 
                                U.S.C. 5196(j)(9)); and
                                  (III) the amount allocated 
                                for purposes under clause (i) 
                                does not exceed the greater of 
                                $1,000,000 or 15 percent of the 
                                grant award.
          (5) Recreation.--Grants awarded under this subtitle 
        may not be used for recreational or social purposes.
  (c) Multiple-Purpose Funds.--Nothing in this subtitle shall 
be construed to prohibit State, local, or tribal governments 
from using grant funds under sections 2003 and 2004 in a manner 
that enhances preparedness for disasters unrelated to acts of 
terrorism, if such use assists such governments in achieving 
target capabilities related to preventing, preparing for, 
protecting against, or responding to acts of terrorism.
  (d) Reimbursement of Costs.--
          (1) Paid-on-call or volunteer reimbursement.--In 
        addition to the activities described in subsection (a), 
        a grant under section 2003 or 2004 may be used to 
        provide a reasonable stipend to paid-on-call or 
        volunteer emergency response providers who are not 
        otherwise compensated for travel to or participation in 
        training or exercises related to the purposes of this 
        subtitle. Any such reimbursement shall not be 
        considered compensation for purposes of rendering an 
        emergency response provider an employee under the Fair 
        Labor Standards Act of 1938 (29 U.S.C. 201 et seq.).
          (2) Performance of federal duty.--An applicant for a 
        grant under section 2003 or 2004 may petition the 
        Administrator to use the funds from its grants under 
        those sections for the reimbursement of the cost of any 
        activity relating to preventing, preparing for, 
        protecting against, or responding to acts of terrorism 
        that is a Federal duty and usually performed by a 
        Federal agency, and that is being performed by a State 
        or local government under agreement with a Federal 
        agency.
  (e) Flexibility in Unspent Homeland Security Grant Funds.--
Upon request by the recipient of a grant under section 2003 or 
2004, the Administrator may authorize the grant recipient to 
transfer all or part of the grant funds from uses specified in 
the grant agreement to other uses authorized under this 
section, if the Administrator determines that such transfer is 
in the interests of homeland security.
  (f) Equipment Standards.--If an applicant for a grant under 
section 2003 or 2004 proposes to upgrade or purchase, with 
assistance provided under that grant, new equipment or systems 
that do not meet or exceed any applicable national voluntary 
consensus standards developed under section 647 of the Post-
Katrina Emergency Management Reform Act of 2006 (6 U.S.C. 747), 
the applicant shall include in its application an explanation 
of why such equipment or systems will serve the needs of the 
applicant better than equipment or systems that meet or exceed 
such standards.

           *       *       *       *       *       *       *

                                  [all]
```