II 

117TH CONGRESS 

1ST SESSION S. 2926 

To require certain entities to disclose to the Secretary of Homeland Security 

ransom payments, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 4, 2021 

Ms. WARREN introduced the following bill; which was read twice and referred 

to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To require certain entities to disclose to the Secretary of 

Homeland Security ransom payments, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. DISCLOSURE OF RANSOM PAYMENTS. 

4 (a) DEFINITIONS.—In this section: 

5 (1) COVERED ENTITY.—The term ‘‘covered en6 tity’’— 

7 (A) means a public or private entity that— 

8 (i) is engaged in interstate commerce 

9 or an activity affecting interstate com10 merce; or 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 2926 IS

1 (ii) receives Federal funds; 

2 (B) includes a local government; and 

3 (C) does not include an individual. 

4 (2) INFORMATION SYSTEM.—The term ‘‘infor5 mation system’’ has the meaning given such term in 

6 section 3502 of title 44, United States Code. 

7 (3) RANSOM.—The term ‘‘ransom’’ means 

8 money or other thing of value demanded by an actor 

9 from a covered entity or individual after such actor 

10 gains control of an information system of such entity 

11 or individual. 

12 (4) SECRETARY.—The term ‘‘Secretary’’ means 

13 the Secretary of Homeland Security. 

14 (b) DISCLOSURE REQUIRED.—Not later than 7 days 

15 after the date on which a covered entity pays a ransom, 

16 the entity shall disclose to the Secretary, in accordance 

17 with subsection (b), such payment. 

18 (c) CONTENTS.—A disclosure made under subsection 

19 (b) shall include, with respect to the ransom at issue, the 

20 following: 

21 (1) The date on which such ransom was de22 manded. 

23 (2) The date on which such ransom was paid. 

24 (3) The amount of such ransom demanded. 

25 (4) The amount of such ransom paid. 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 2926 IS

1 (5) An identification of the currency, including 

2 if cryptocurrency, used for payment of such ransom. 

3 (6) Whether the covered entity that paid such 

4 ransom receives Federal funds. 

5 (7) Any known information regarding the iden6 tity of the actor demanding such ransom. 

7 (d) NONCOMPLIANCE.—The Secretary shall establish 

8 by regulation appropriate penalties for a covered entity 

9 that fails to make a disclosure required under subsection 

10 (b). 

11 (e) PUBLIC AVAILABILITY.— 

12 (1) IN GENERAL.—Not later than 1 year after 

13 the date of the enactment of this Act and annually 

14 thereafter, the Secretary shall publish on a publicly 

15 available website of the Department of Homeland 

16 Security the information disclosed under subsection 

17 (b) during the preceding 1-year period, including the 

18 total dollar amount of ransoms paid by covered enti19 ties during such period. 

20 (2) EXCLUSION OF IDENTIFYING INFORMA21 TION.—Information that reveals the identity of a 

22 covered entity that made a disclosure under sub23 section (b) shall be excluded from the information 

24 published under paragraph (1). 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 2926 IS

1 (f) STUDY AND REPORT ON RANSOM COMMONAL2 ITIES.— 

3 (1) STUDY.—The Secretary shall conduct a 

4 study to determine if— 

5 (A) there are commonalities with respect to 

6 the information disclosed under subsection (b); 

7 and 

8 (B) the extent to which cryptocurrency has 

9 facilitated the kinds of attacks that resulted in 

10 the payment of ransoms by covered entities. 

11 (2) REPORT.—Not later than 15 months after 

12 the date of the enactment of this Act, the Secretary 

13 shall submit to Congress a report that includes— 

14 (A) the findings of the study conducted 

15 under paragraph (1); and 

16 (B) such recommendations as the Sec17 retary considers appropriate for protecting the 

18 information systems of covered entities. 

19 (g) INDIVIDUAL REPORTING.— 

20 (1) IN GENERAL.—Not later than December 21, 

21 2021, the Secretary shall establish a website through 

22 which individuals may voluntarily report the pay23 ment of a ransom by the individual. 

24 (2) INCORPORATION OF DATA.—To the greatest 

25 extent practicable, the Secretary shall incorporate 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 2926 IS

1 data from reporting by individuals under paragraph 

2 (1) in— 

3 (A) the information published under sub4 section (e); and 

5 (B) the study conducted under subsection 

6 (f). 

7 (h) APPLICABILITY.—This section shall apply to ran8 soms paid on or after the date that is 90 days after the 

9 date of the enactment of this Act. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS