I 

114TH CONGRESS 

1ST SESSION H. R. 3305 

To help enhance American network security and mitigate cybersecurity risks, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 29, 2015 

Mr. HURD of Texas (for himself, Mr. MCCAUL, and Mr. RATCLIFFE) introduced the following bill; which was referred to the Committee on Oversight and Government Reform, and in addition to the Committee on 

Homeland Security, for a period to be subsequently determined by the 

Speaker, in each case for consideration of such provisions as fall within 

the jurisdiction of the committee concerned 

A BILL 

To help enhance American network security and mitigate 

cybersecurity risks, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘EINSTEIN Act of 

5 2015’’. 


rfrederick on DSK6VPTVN1PROD with BILLS
2 

•HR 3305 IH

1 SEC. 2. PROTECTION OF FEDERAL CIVILIAN INFORMATION 

2 SYSTEMS. 

3 (a) IN GENERAL.—Subtitle C of title II of the Home4 land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend5 ed by adding at the end the following new section: 

6 ‘‘SEC. 230. AVAILABLE PROTECTION OF FEDERAL CIVILIAN 

7 INFORMATION SYSTEMS. 

8 ‘‘(a) IN GENERAL.—The Secretary shall deploy, oper9 ate, and maintain, to make available for use by any Fed10 eral agency, with or without reimbursement, capabilities 

11 to protect Federal agency information and Federal civilian 

12 information systems, including technologies to diagnose, 

13 detect, prevent, and mitigate against cybersecurity risks 

14 involving Federal agency information or Federal civilian 

15 information systems. 

16 ‘‘(b) ACTIVITIES.—In carrying out this section, the 

17 Secretary may— 

18 ‘‘(1) access, and Federal agency heads may dis19 close to the Secretary or a private entity providing 

20 assistance to the Secretary under paragraph (2), in21 formation traveling to or from or stored on a Fed22 eral civilian information system, regardless of from 

23 where the Secretary or a private entity providing as24 sistance to the Secretary under paragraph (2) ac25 cesses such information, notwithstanding any other 

26 provision of law that would otherwise restrict or preVerDate Sep 11 2014 01:57 Aug 04, 2015 Jkt 049200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3305.IH H3305

rfrederick on DSK6VPTVN1PROD with BILLS
3 

•HR 3305 IH

1 vent Federal agency heads from disclosing such in2 formation to the Secretary or a private entity pro3 viding assistance to the Secretary under paragraph 

4 (2); 

5 ‘‘(2) enter into contracts or other agreements, 

6 or otherwise request and obtain the assistance of, 

7 private entities to deploy, operate, and maintain 

8 technologies in accordance with subsection (a); and 

9 ‘‘(3) retain, use, and disclose information ob10 tained through the conduct of activities authorized 

11 under this section only to protect Federal agency in12 formation and Federal civilian information systems 

13 from cybersecurity risks or in furtherance of the na14 tional cybersecurity and communications integration 

15 center’s authority under the second section 226, or, 

16 with the approval of the Attorney General and if dis17 closure of such information is not otherwise prohib18 ited by law, to law enforcement only to investigate, 

19 prosecute, disrupt, or otherwise respond to— 

20 ‘‘(A) a violation of section 1030 of title 18, 

21 United States Code; 

22 ‘‘(B) an imminent threat of death or seri23 ous bodily harm; 


rfrederick on DSK6VPTVN1PROD with BILLS
4 

•HR 3305 IH

1 ‘‘(C) a serious threat to a minor, including 

2 sexual exploitation or threats to physical safety; 

3 or 

4 ‘‘(D) an attempt, or conspiracy, to commit 

5 an offense described in any of subparagraphs 

6 (A) through (C). 

7 ‘‘(c) CONDITIONS.—Contracts or other agreements 

8 under subsection (b)(2) shall include appropriate provi9 sions barring— 

10 ‘‘(1) the disclosure of information to any entity 

11 other than the Department or a Federal agency dis12 closing information in accordance with subsection 

13 (b)(1) that can be used to identify specific persons 

14 and is reasonably believed to be unrelated to a cy15 bersecurity risk; and 

16 ‘‘(2) the use of any information to which such 

17 private entity gains access in accordance with this 

18 section for any purpose other than to protect Fed19 eral agency information and Federal civilian infor20 mation systems against cybersecurity risks or to ad21 minister any such contract or other agreement. 

22 ‘‘(d) LIMITATION.—No cause of action shall lie in any 

23 court against a private entity for assistance provided to 

24 the Secretary in accordance with this section and a con25 tract or agreement under subsection (b)(2). 


rfrederick on DSK6VPTVN1PROD with BILLS
5 

•HR 3305 IH

1 ‘‘(e) DEFINITION.—The term ‘cybersecurity risk’ has 

2 the meaning given such term in the second section 226 

3 (relating to the national cybersecurity and communica4 tions integration center).’’. 

5 (b) DEFINITIONS.—Paragraphs (1) and (2) of the 

6 second section 226 of the Homeland Security Act of 2002 

7 (6 U.S.C. 148; relating to the national cybersecurity and 

8 communications integration center) are amended to read 

9 as follows: 

10 ‘‘(1)(A) except as provided in subparagraph 

11 (B), the term ‘cybersecurity risk’ means threats to 

12 and vulnerabilities of information or information sys13 tems and any related consequences caused by or re14 sulting from unauthorized access, use, disclosure, 

15 degradation, disruption, modification, or destruction 

16 of such information or information systems, includ17 ing such related consequences caused by an act of 

18 terrorism; and 

19 ‘‘(B) such term does not include any action that 

20 solely involves a violation of a consumer term of 

21 service or a consumer licensing agreement; 

22 ‘‘(2) the term ‘incident’ means an occurrence 

23 that actually or imminently jeopardizes, without law24 ful authority, the integrity, confidentiality, or avail25 ability of information on an information system, or 


rfrederick on DSK6VPTVN1PROD with BILLS
6 

•HR 3305 IH

1 actually or imminently jeopardizes, without lawful 

2 authority, an information system;’’. 

3 (c) CLERICAL AMENDMENT.—The table of contents 

4 of the Homeland Security Act of 2002 is amended by add5 ing at the end the following new item: 

‘‘Sec. 230. Available protection of Federal civilian information systems.’’. 

Æ 


rfrederick on DSK6VPTVN1PROD with BILLS