I 

114TH CONGRESS 

1ST SESSION H. R. 3039 

To impose penalties on state-sponsors of cyberattacks, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 13, 2015 

Mr. BROOKS of Alabama introduced the following bill; which was referred to 

the Committee on Foreign Affairs, and in addition to the Committees on 

Ways and Means, Financial Services, and Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each 

case for consideration of such provisions as fall within the jurisdiction of 

the committee concerned 

A BILL 

To impose penalties on state-sponsors of cyberattacks, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Providing Retaliation 

5 Options against Those Engaging in Cyberattacks Tar6 geting the United States Act’’ or ‘‘PROTECT US Act’’. 

7 SEC. 2. FINDINGS. 

8 Congress finds the following: 


SSpencer on DSK4SPTVN1PROD with BILLS
2 

•HR 3039 IH

1 (1) Article XXI of the GATT 1994 (as such 

2 term is defined in section 2(1)(B) of the Uruguay 

3 Round Agreements Act (19 U.S.C. 3501(1)(B))) al4 lows a member of the World Trade Organization to 

5 take any action which such member considers nec6 essary for the protection of such member’s essential 

7 security interests. 

8 (2) Protecting the United States from malicious 

9 cyber-enabled activities is essential to the security 

10 interests of the United States. 

11 SEC. 3. IMPOSITION OF PENALTIES ON STATE-SPONSORS 

12 OF CYBERATTACKS. 

13 (a) IN GENERAL.—The President is authorized to 

14 impose penalties described in subsection (c) with respect 

15 to each country on the list required by subsection (b). 

16 (b) LIST OF STATE-SPONSORS OF CYBERATTACKS.— 

17 (1) IN GENERAL.—Not later than 60 days after 

18 the date of the enactment of this Act, the President 

19 shall submit to Congress a list of countries des20 ignated as state-sponsors of cyberattacks pursuant 

21 to paragraph (2). 

22 (2) COUNTRIES DESIGNATED.—If the Presi23 dent, in consultation with the Secretary of Home24 land Security, the Secretary of Defense, the Attor25 ney General, and the Chairman of the United States 


SSpencer on DSK4SPTVN1PROD with BILLS
3 

•HR 3039 IH

1 International Trade Commission, determines that 

2 the United States or a United States person has 

3 been targeted in a malicious cyber-enabled activity 

4 originating from, or directed by a person located, in 

5 whole or in substantial part, in a foreign country, 

6 and such activity is reasonably likely to result in, or 

7 have materially contributed to, a threat to the na8 tional security or foreign policy of the United States, 

9 or harmed the economic health or financial stability 

10 of the United States or a United States person, or 

11 has the purpose or effect of— 

12 (A) harming or otherwise significantly 

13 compromising the provision of services by a 

14 computer or network of computers that support 

15 the United States or a United States person in 

16 a critical infrastructure sector, 

17 (B) significantly compromising the provi18 sion of services by the United States or a 

19 United States person in a critical infrastructure 

20 sector, 

21 (C) causing significant disruption to the 

22 availability of a computer or network of com23 puters owned or operated by the United States 

24 or a United States person, or 


SSpencer on DSK4SPTVN1PROD with BILLS
4 

•HR 3039 IH

1 (D) causing a significant misappropriation 

2 of funds or economic resources, trade secrets, 

3 personally identifiable information, or financial 

4 information of the United States or a United 

5 States person, 

6 the President shall designate such country as a 

7 state-sponsor of cyberattacks. 

8 (3) UPDATES OF LIST.—The President shall 

9 submit to Congress an updated list under paragraph 

10 (1) as new information becomes available. 

11 (c) PENALTIES.— 

12 (1) TRADE-RELATED PENALTY.—The President 

13 may impose a duty, in addition to any other duty 

14 imposed, on any article or service imported directly 

15 or indirectly into the United States that is produced 

16 in whole or in part in a country that is included on 

17 the list of state-sponsors of cyberattacks required by 

18 subsection (b). 

19 (2) OTHER ACTIONS.—The President may take 

20 any of the following actions with respect to a coun21 try that is included on the list of state-sponsors of 

22 cyberattacks required by subsection (b): 

23 (A) A private demarche. 

24 (B) An official public demarche. 

25 (C) A public condemnation. 


SSpencer on DSK4SPTVN1PROD with BILLS
5 

•HR 3039 IH

1 (D) A public condemnation within one or 

2 more multilateral fora. 

3 (E) The delay or cancellation of one or 

4 more scientific exchanges. 

5 (F) The delay or cancellation of one or 

6 more cultural exchanges. 

7 (G) The denial of one or more working, of8 ficial, or state visits. 

9 (H) The delay or cancellation of one or 

10 more working, official, or state visits. 

11 (I) The withdrawal, limitation, or suspen12 sion of United States development assistance 

13 under chapter 1 of part I of the Foreign Assist14 ance Act of 1961. 

15 (J) Directing the Export-Import Bank of 

16 the United States, the Overseas Private Invest17 ment Corporation, or the Trade and Develop18 ment Agency to not approve the issuance of any 

19 (or a specified number of) guarantees, insur20 ance, extensions of credit, or participations in 

21 extensions of credit. 

22 (K) The withdrawal, limitation, or suspen23 sion of United States security assistance under 

24 part II of the Foreign Assistance Act of 1961. 


SSpencer on DSK4SPTVN1PROD with BILLS
6 

•HR 3039 IH

1 (L) Consistent with section 701 of the 

2 International Financial Institutions Act, direct3 ing the United States Executive Directors at 

4 international financial institutions to oppose 

5 and vote against loans primarily benefitting the 

6 country. 

7 (M) Ordering the heads of the appropriate 

8 United States agencies to not issue any (or a 

9 specified number of) specific licenses, and to 

10 not grant any other specific authority (or a 

11 specified number of authorities), to export any 

12 goods or technology to such country under— 

13 (i) the Export Administration Act of 

14 1979 (as continued in effect pursuant the 

15 International Emergency Economic Powers 

16 Act); 

17 (ii) the Arms Export Control Act; 

18 (iii) the Atomic Energy Act of 1954; 

19 or 

20 (iv) any other statute that requires 

21 the prior review and approval of the 

22 United States Government as a condition 

23 for the export or re-export of goods or 

24 services. 


SSpencer on DSK4SPTVN1PROD with BILLS
7 

•HR 3039 IH

1 (N) Prohibiting any United States finan2 cial institution from making loans or providing 

3 credits. 

4 (O) Prohibiting the United States Govern5 ment from procuring, or entering into any con6 tract for the procurement of, any goods or serv7 ices. 

8 (P) Suspension or withdrawal of extension 

9 of nondiscriminatory treatment to the products 

10 of the country pursuant to section 404 of the 

11 Trade Act of 1974. 

12 (Q) Ordering a trade embargo. 

13 (R) Ordering a cyber counterattack. 

14 (d) REMOVAL FROM LIST.— 

15 (1) IN GENERAL.—A country may be removed 

16 from the list of state-sponsors of cyberattacks re17 quired by subsection (b) if— 

18 (A) the President determines that the 

19 country no longer meets the requirements for 

20 designation as a state-sponsor of cyberattacks 

21 under subsection (b)(2); or 

22 (B) Congress enacts a law that provides 

23 for such removal. 

24 (2) MORATORIUM.— 


SSpencer on DSK4SPTVN1PROD with BILLS
8 

•HR 3039 IH

1 (A) IN GENERAL.—A country that has 

2 been removed from the list pursuant to para3 graph (1)(B) may not be added back to the list 

4 by the President until at least the date that is 

5 one year after the date of such removal. 

6 (B) RULE OF CONSTRUCTION.—Nothing in 

7 this paragraph shall be construed as prohibiting 

8 Congress from adding a country that has been 

9 removed from the list pursuant to paragraph 

10 (1)(B) back to the list by a date that is earlier 

11 than the date described in subparagraph (A). 

12 (e) DEFINITIONS.—In this section: 

13 (1) CRITICAL INFRASTRUCTURE SECTOR.—The 

14 term ‘‘critical infrastructure sector’’ means any of 

15 the designated critical infrastructure sectors identi16 fied in Presidential Policy Directive 21. 

17 (2) ENTITY.—The term ‘‘entity’’ means a part18 nership, association, trust, joint venture, corpora19 tion, group, subgroup, government, or other organi20 zation. 

21 (3) LIST.—The term ‘‘list’’ means the list of 

22 state-sponsors of cyberattacks. 

23 (4) MISAPPROPRIATION.—The term ‘‘misappro24 priation’’ means any taking or obtaining by imVerDate Sep 11 2014 03:27 Jul 15, 2015 Jkt 049200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H3039.IH H3039

SSpencer on DSK4SPTVN1PROD with BILLS
9 

•HR 3039 IH

1 proper means, without permission or consent, or 

2 under false pretenses. 

3 (5) PERSON.—The term ‘‘person’’ means a nat4 ural person or an entity. 

5 (6) UNITED STATES PERSON.—The term 

6 ‘‘United States person’’ shall be broadly construed 

7 to include but not be limited to any United States 

8 citizen, permanent resident alien, entity organized 

9 under the laws of the United States or any jurisdic10 tion within the United States (including foreign 

11 branches), any governmental or quasi-governmental 

12 entity existing in the United States, or any other 

13 person in the United States. 

Æ 


SSpencer on DSK4SPTVN1PROD with BILLS