I 

114TH CONGRESS 

1ST SESSION H. R. 3402 

To strengthen the ability of the Secretary of Homeland Security to detect 

and prevent intrusions against, and to use countermeasures to protect, 

government agency information systems and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 29, 2015 

Mr. RUPPERSBERGER introduced the following bill; which was referred to the 

Committee on Oversight and Government Reform 

A BILL 

To strengthen the ability of the Secretary of Homeland Security to detect and prevent intrusions against, and to 

use countermeasures to protect, government agency information systems and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Information 

5 Security Management Reform Act of 2015’’. 


srobinson on DSK5SPTVN1PROD with BILLS
2 

•HR 3402 IH

1 SEC. 2. DUTIES OF THE SECRETARY OF HOMELAND SECU2 RITY RELATED TO INFORMATION SECURITY. 

3 Section 3553(b)(6) of title 44, United States Code, 

4 is amended by striking subparagraphs (B), (C), and (D) 

5 and inserting the following: 

6 ‘‘(B) operating consolidated intrusion de7 tection, prevention, or other protective capabili8 ties and use of associated countermeasures for 

9 the purpose of protecting agency information 

10 and information systems from information secu11 rity threats; 

12 ‘‘(C) providing incident detection, analysis, 

13 mitigation, and response information and re14 mote or onsite technical assistance to the head 

15 of an agency; 

16 ‘‘(D) compiling and analyzing data on 

17 agency information security; 

18 ‘‘(E) developing and conducting targeted 

19 risk assessments and operational evaluations for 

20 agency information and information systems in 

21 consultation with the heads of other agencies or 

22 governmental and private entities that own and 

23 operate such systems, that may include threat, 

24 vulnerability, and impact assessments; 

25 ‘‘(F) in conjunction with other agencies 

26 and the private sector, assessing and fostering 


srobinson on DSK5SPTVN1PROD with BILLS
3 

•HR 3402 IH

1 the development of information security tech2 nologies and capabilities for use across multiple 

3 agencies; and 

4 ‘‘(G) coordinating with appropriate agen5 cies and officials to ensure, to the maximum ex6 tent feasible, that policies and directives issued 

7 under paragraph (2) are complementary with— 

8 ‘‘(i) standards and guidelines devel9 oped for national security systems; and 

10 ‘‘(ii) policies and directives issued by 

11 the Secretary of Defense and the Director 

12 of National Intelligence under subsection 

13 (e)(1); and’’. 

14 SEC. 3. COMMUNICATIONS AND SYSTEM TRAFFIC AND DI15 RECTION TO AGENCIES. 

16 Section 3553 of title 44, United States Code, is 

17 amended by adding at the end the following: 

18 ‘‘(h) COMMUNICATIONS AND SYSTEMS TRAFFIC.— 

19 ‘‘(1) IN GENERAL.— 

20 ‘‘(A) ACQUISITION BY THE SECRETARY.— 

21 Notwithstanding any other provision of law and 

22 subject to subparagraph (B), in carrying out 

23 the responsibilities under subparagraphs (B), 

24 (C), and (E) of subsection (b)(6), if the Sec25 retary makes a certification described in paraVerDate Sep 11 2014 18:19 Aug 07, 2015 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3402.IH H3402

srobinson on DSK5SPTVN1PROD with BILLS
4 

•HR 3402 IH

1 graph (2), the Secretary may acquire, intercept, 

2 retain, use, and disclose communications and 

3 other system traffic that are transiting to or 

4 from or stored on agency information systems 

5 and deploy countermeasures with regard to the 

6 communications and system traffic. 

7 ‘‘(B) EXCEPTION.—The authorities of the 

8 Secretary under this subsection shall not apply 

9 to a communication or other system traffic that 

10 is transiting to or from or stored on a system 

11 described in paragraph (2) or (3) of subsection 

12 (e). 

13 ‘‘(C) DISCLOSURE BY FEDERAL AGENCY

14 HEADS.—The head of a Federal agency or de15 partment is authorized to disclose to the Sec16 retary or a private entity providing assistance 

17 to the Secretary under paragraph (A), informa18 tion traveling to or from or stored on an agency 

19 information system, notwithstanding any other 

20 law that would otherwise restrict or prevent 

21 agency heads from disclosing such information 

22 to the Secretary. 

23 ‘‘(2) CERTIFICATION.—A certification described 

24 in this paragraph is a certification by the Secretary 

25 that— 


srobinson on DSK5SPTVN1PROD with BILLS
5 

•HR 3402 IH

1 ‘‘(A) the acquisitions, interceptions, and 

2 other countermeasures are reasonably necessary 

3 for the purpose of protecting agency informa4 tion systems from information security threats; 

5 ‘‘(B) the content of communications will be 

6 retained only if the communication is associated 

7 with a known or reasonably suspected informa8 tion security threat, and communications and 

9 system traffic will not be subject to the oper10 ation of a countermeasure unless associated 

11 with the threats; 

12 ‘‘(C) information obtained under activities 

13 authorized under this subsection will only be re14 tained, used, or disclosed to protect agency in15 formation systems from information security 

16 threats, mitigate against such threats, or, with 

17 the approval of the Attorney General, for law 

18 enforcement purposes when the information is 

19 evidence of a crime which has been, is being, or 

20 is about to be committed; 

21 ‘‘(D) notice has been provided to users of 

22 agency information systems concerning the po23 tential for acquisition, interception, retention, 

24 use, and disclosure of communications and 

25 other system traffic; and 


srobinson on DSK5SPTVN1PROD with BILLS
6 

•HR 3402 IH

1 ‘‘(E) the activities are implemented pursu2 ant to policies and procedures governing the ac3 quisition, interception, retention, use, and dis4 closure of communications and other system 

5 traffic that have been reviewed and approved by 

6 the Attorney General. 

7 ‘‘(3) PRIVATE ENTITIES.—The Secretary may 

8 enter into contracts or other agreements, or other9 wise request and obtain the assistance of, private en10 tities that provide electronic communication or infor11 mation security services to acquire, intercept, retain, 

12 use, and disclose communications and other system 

13 traffic in accordance with this subsection. 

14 ‘‘(4) NO CAUSE OF ACTION.—No cause of ac15 tion shall exist against a private entity for assistance 

16 provided to the Secretary in accordance with para17 graph (3). 

18 ‘‘(i) DIRECTION TO AGENCIES.— 

19 ‘‘(1) AUTHORITY.— 

20 ‘‘(A) IN GENERAL.—Notwithstanding sec21 tion 3554, and subject to subparagraph (B), in 

22 response to a known or reasonably suspected in23 formation security threat, vulnerability, or inci24 dent that represents a substantial threat to the 

25 information security of an agency, the Secretary 


srobinson on DSK5SPTVN1PROD with BILLS
7 

•HR 3402 IH

1 may issue a directive to the head of an agency 

2 to take any lawful action with respect to the op3 eration of the information system, including 

4 such systems owned or operated by another en5 tity on behalf of an agency, that collects, proc6 esses, stores, transmits, disseminates, or other7 wise maintains agency information, for the pur8 pose of protecting the information system from, 

9 or mitigating, an information security threat. 

10 ‘‘(B) EXCEPTION.—The authorities of the 

11 Secretary under this subsection shall not apply 

12 to a system described in paragraph (2) or (3) 

13 of subsection (e). 

14 ‘‘(2) PROCEDURES FOR USE OF AUTHORITY.— 

15 The Secretary shall— 

16 ‘‘(A) in coordination with the Director and 

17 in consultation with Federal contractors, as ap18 propriate, establish procedures governing the 

19 circumstances under which a directive may be 

20 issued under this subsection, which shall in21 clude— 

22 ‘‘(i) thresholds and other criteria; 

23 ‘‘(ii) privacy and civil liberties protec24 tions; and 


srobinson on DSK5SPTVN1PROD with BILLS
8 

•HR 3402 IH

1 ‘‘(iii) providing notice to potentially 

2 affected third parties; 

3 ‘‘(B) specify the reasons for the required 

4 action and the duration of the directive; 

5 ‘‘(C) minimize the impact of a directive 

6 under this subsection by— 

7 ‘‘(i) adopting the least intrusive 

8 means possible under the circumstances to 

9 secure the agency information systems; 

10 and 

11 ‘‘(ii) limiting directives to the shortest 

12 period practicable; and 

13 ‘‘(D) notify the Director and the head of 

14 any affected agency immediately upon the 

15 issuance of a directive under this subsection. 

16 ‘‘(3) IMMINENT THREATS.— 

17 ‘‘(A) IN GENERAL.—If the Secretary deter18 mines that there is an imminent threat to agen19 cy information systems and a directive under 

20 this subsection is not reasonably likely to result 

21 in a timely response to the threat, the Secretary 

22 may authorize the use of protective capabilities 

23 under the control of the Secretary for commu24 nications or other system traffic transiting to or 

25 from or stored on an agency information system 


srobinson on DSK5SPTVN1PROD with BILLS
9 

•HR 3402 IH

1 without prior consultation with the affected 

2 agency for the purpose of ensuring the security 

3 of the information or information system or 

4 other agency information systems. 

5 ‘‘(B) LIMITATION ON DELEGATION.—The 

6 authority under this paragraph may not be del7 egated to an official in a position lower than an 

8 Assistant Secretary of the Department of 

9 Homeland Security. 

10 ‘‘(C) NOTICE.—The Secretary shall imme11 diately notify the Director and the head and 

12 chief information officer (or equivalent official) 

13 of each affected agency of— 

14 ‘‘(i) any action taken under this sub15 section; and 

16 ‘‘(ii) the reasons for and duration and 

17 nature of the action. 

18 ‘‘(D) OTHER LAW.—Any action of the Sec19 retary under this paragraph shall be consistent 

20 with applicable law. 

21 ‘‘(4) LIMITATION.—The Secretary may direct 

22 or authorize lawful action or protective capability 

23 under this subsection only to— 


srobinson on DSK5SPTVN1PROD with BILLS
10 

•HR 3402 IH

1 ‘‘(A) protect agency information from un2 authorized access, use, disclosure, disruption, 

3 modification, or destruction; or 

4 ‘‘(B) require the remediation of or protect 

5 against identified information security risks 

6 with respect to— 

7 ‘‘(i) information collected or main8 tained by or on behalf of an agency; or 

9 ‘‘(ii) that portion of an information 

10 system used or operated by an agency or 

11 by a contractor of an agency or other orga12 nization on behalf of an agency.’’. 

13 SEC. 4. REPORT TO CONGRESS REGARDING OFFICE OF 

14 MANAGEMENT AND BUDGET ENFORCEMENT 

15 ACTION. 

16 Section 3553 of title 44, United States Code, as 

17 amended by section 3, is further amended by inserting the 

18 following at the end the following new subsection: 

19 ‘‘(j) ANNUAL REPORT TO CONGRESS.— 

20 ‘‘(1) REQUIREMENT.—Not later than February 

21 1 of every year, the Director shall report to the ap22 propriate congressional committee regarding the spe23 cific actions the Director has taken pursuant to sub24 section (a)(5), including any actions taken pursuant 

25 to paragraph (5) of title 40 section 11303(b). 


srobinson on DSK5SPTVN1PROD with BILLS
11 

•HR 3402 IH

1 ‘‘(2) APPROPRIATE CONGRESSIONAL COM2 MITTEE.—In this subsection, the term ‘appropriate 

3 congressional committee’ means— 

4 ‘‘(A) the Committee on Appropriations and 

5 the Committee on Homeland Security and Gov6 ernmental Affairs of the Senate; and 

7 ‘‘(B) the Committee on Appropriations and 

8 the Committee on Homeland Security Com9 mittee of the House of Representatives.’’. 

Æ 


srobinson on DSK5SPTVN1PROD with BILLS