II 

117TH CONGRESS 

1ST SESSION S. 2943 

To require certain entities to disclose to the Secretary of Homeland Security 

ransom payments, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 6, 2021 

Ms. WARREN introduced the following bill; which was read twice and referred 

to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To require certain entities to disclose to the Secretary of 

Homeland Security ransom payments, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Ransom Disclosure 

5 Act’’. 

6 SEC. 2. DISCLOSURE OF RANSOM PAYMENTS. 

7 (a) DEFINITIONS.—In this section: 

8 (1) COVERED ENTITY.—The term ‘‘covered en9 tity’’— 

10 (A) means a public or private entity that— 


pbinns on DSKJLVW7X2PROD with BILLS
2 

•S 2943 IS

1 (i) is engaged in interstate commerce 

2 or an activity affecting interstate com3 merce; or 

4 (ii) receives Federal funds; 

5 (B) includes a local government; and 

6 (C) does not include an individual. 

7 (2) INFORMATION SYSTEM.—The term ‘‘infor8 mation system’’ has the meaning given such term in 

9 section 3502 of title 44, United States Code. 

10 (3) RANSOM.—The term ‘‘ransom’’ means 

11 money or other thing of value demanded by an actor 

12 from a covered entity or individual after such actor 

13 gains control of an information system of such entity 

14 or individual. 

15 (4) SECRETARY.—The term ‘‘Secretary’’ means 

16 the Secretary of Homeland Security. 

17 (b) DISCLOSURE REQUIRED.—Not later than 48 

18 hours after a covered entity pays a ransom, the covered 

19 entity shall disclose to the Secretary, in accordance with 

20 subsection (c), such payment. 

21 (c) CONTENTS.—A disclosure made under subsection 

22 (b) shall include, with respect to the ransom at issue, the 

23 following: 

24 (1) The date on which such ransom was de25 manded. 


pbinns on DSKJLVW7X2PROD with BILLS
3 

•S 2943 IS

1 (2) The date on which such ransom was paid. 

2 (3) The amount of such ransom demanded. 

3 (4) The amount of such ransom paid. 

4 (5) An identification of the currency, including 

5 if cryptocurrency, used for payment of such ransom. 

6 (6) Whether the covered entity that paid such 

7 ransom receives Federal funds. 

8 (7) Any known information regarding the iden9 tity of the actor demanding such ransom. 

10 (d) NONCOMPLIANCE.—The Secretary shall establish 

11 by regulation appropriate penalties for a covered entity 

12 that fails to make a disclosure required under subsection 

13 (b). 

14 (e) PUBLIC AVAILABILITY.— 

15 (1) IN GENERAL.—Not later than 1 year after 

16 the date of the enactment of this Act and annually 

17 thereafter, the Secretary shall publish on a publicly 

18 available website of the Department of Homeland 

19 Security the information disclosed under subsection 

20 (b) during the preceding 1-year period, including the 

21 total dollar amount of ransoms paid by covered enti22 ties during such period. 

23 (2) EXCLUSION OF IDENTIFYING INFORMA24 TION.—Information that reveals the identity of a 

25 covered entity that made a disclosure under subVerDate Sep 11 2014 01:59 Oct 14, 2021 Jkt 029200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2943.IS S2943

pbinns on DSKJLVW7X2PROD with BILLS
4 

•S 2943 IS

1 section (b) shall be excluded from the information 

2 published under paragraph (1). 

3 (f) STUDY AND REPORT ON RANSOM COMMONAL4 ITIES.— 

5 (1) STUDY.—The Secretary shall conduct a 

6 study to determine— 

7 (A) if there are commonalities with respect 

8 to the information disclosed under subsection 

9 (b); and 

10 (B) the extent to which cryptocurrency has 

11 facilitated the kinds of attacks that resulted in 

12 the payment of ransoms by covered entities. 

13 (2) REPORT.—Not later than 15 months after 

14 the date of the enactment of this Act, the Secretary 

15 shall submit to Congress a report that includes— 

16 (A) the findings of the study conducted 

17 under paragraph (1); and 

18 (B) such recommendations as the Sec19 retary considers appropriate for protecting the 

20 information systems of covered entities. 

21 (g) INDIVIDUAL REPORTING.— 

22 (1) IN GENERAL.—Not later than 60 days after 

23 the date of enactment of this Act, the Secretary 

24 shall establish a website through which individuals 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•S 2943 IS

1 may voluntarily report the payment of a ransom by 

2 the individual. 

3 (2) INCORPORATION OF DATA.—To the greatest 

4 extent practicable, the Secretary shall incorporate 

5 data from reporting by individuals under paragraph 

6 (1) in— 

7 (A) the information published under sub8 section (e); and 

9 (B) the study conducted under subsection 

10 (f). 

11 (h) APPLICABILITY.—This section shall apply to ran12 soms paid on or after the date that is 90 days after the 

13 date of the enactment of this Act. 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS