I 

116TH CONGRESS 

1ST SESSION H. R. 3270 

To amend title 18, United States Code, to provide a defense to prosecution 

for fraud and related activity in connection with computers for persons 

defending against unauthorized intrusions into their computers, and for 

other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 13, 2019 

Mr. GRAVES of Georgia (for himself, Mr. GOTTHEIMER, Mr. AUSTIN SCOTT

of Georgia, Mr. CUELLAR, Mr. CARTER of Georgia, Mr. FERGUSON, Mr. 

RIGGLEMAN, Mr. LOUDERMILK, Mr. STEWART, Mr. PALAZZO, Mr. HILL

of Arkansas, Mr. BUDD, Mr. FORTENBERRY, Mrs. MURPHY, Mr. 

RESCHENTHALER, and Miss RICE of New York) introduced the following 

bill; which was referred to the Committee on the Judiciary 

A BILL 

To amend title 18, United States Code, to provide a defense 

to prosecution for fraud and related activity in connection with computers for persons defending against unauthorized intrusions into their computers, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Active Cyber Defense 

5 Certainty Act’’. 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 3270 IH

1 SEC. 2. CONGRESSIONAL FINDINGS. 

2 Congress finds the following: 

3 (1) Cyber fraud and related cyber-enabled 

4 crimes pose a severe threat to the national security 

5 and economic vitality of the United States. 

6 (2) As a result of the unique nature of 

7 cybercrime, it is very difficult for law enforcement to 

8 respond to and prosecute cybercrime in a timely 

9 manner, leading to the existing low level of deter10 rence and a rapidly growing threat. In 2017, the De11 partment of Justice prosecuted only 165 cases of 

12 computer fraud. Congress determines that this sta13 tus quo is unacceptable and that if left unchecked, 

14 the trend in cybercrime will only continue to deterio15 rate. 

16 (3) Cybercriminals have developed new tactics 

17 for monetizing the proceeds of their criminal acts, 

18 making it likely that the criminal activity will be fur19 ther incentivized in the absence of reforms to cur20 rent law allowing for new cyber tools and deterrence 

21 methods for defenders. 

22 (4) When a citizen or United States business is 

23 victimized as the result of such crime, the first re24 course should be to report the crime to law enforce25 ment and seek to improve defensive measures. 


kjohnson on DSK79L0C42 with BILLS
3 

•HR 3270 IH

1 (5) Congress also acknowledges that many 

2 cyberattacks could be prevented through improved 

3 cyber defensive practices, including enhanced train4 ing, strong passwords, and routine updating and 

5 patching to computer systems. 

6 (6) Congress determines that the use of active 

7 cyber defense techniques, when properly applied, can 

8 also assist in improving defenses and deterring 

9 cybercrimes. 

10 (7) Congress also acknowledges that many pri11 vate entities are increasingly concerned with stem12 ming the growth of dark web based cyber-enabled 

13 crimes. The Department of Justice should attempt 

14 to clarify the proper protocol for entities who are en15 gaged in active cyber defense in the dark web so 

16 that these defenders can return private property 

17 such as intellectual property and financial records 

18 gathered inadvertently. 

19 (8) Congress also recognizes that while Federal 

20 agencies will need to prioritize cyber incidents of na21 tional significance, there is the potential to assist the 

22 private sector by being more responsive to reports of 

23 crime through different reporting mechanisms. Many 

24 reported cybercrimes are not responded to in a timeVerDate Sep 11 2014 04:22 Jun 18, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3270.IH H3270

kjohnson on DSK79L0C42 with BILLS
4 

•HR 3270 IH

1 ly manner creating significant uncertainty for many 

2 businesses and individuals. 

3 (9) Computer defenders should also exercise ex4 treme caution to avoid violating the law of any other 

5 nation where an attacker’s computer may reside. 

6 (10) Congress holds that active cyber defense 

7 techniques should only be used by qualified defend8 ers with a high degree of confidence in attribution, 

9 and that extreme caution should be taken to avoid 

10 impacting intermediary computers or resulting in an 

11 escalatory cycle of cyber activity. 

12 (11) It is the purpose of this Act to provide 

13 legal certainty by clarifying the type of tools and 

14 techniques that defenders can use that exceed the 

15 boundaries of their own computer network. 

16 SEC. 3. EXCEPTION FOR THE USE OF ATTRIBUTIONAL 

17 TECHNOLOGY. 

18 Section 1030 of title 18, United States Code, is 

19 amended by adding at the end the following: 

20 ‘‘(k) EXCEPTION FOR THE USE OF ATTRIBUTIONAL

21 TECHNOLOGY.— 

22 ‘‘(1) This section shall not apply with respect to 

23 the use of attributional technology in regard to a de24 fender who uses a program, code, or command for 

25 attributional purposes that beacons or returns locaVerDate Sep 11 2014 04:22 Jun 18, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3270.IH H3270

kjohnson on DSK79L0C42 with BILLS
5 

•HR 3270 IH

1 tional or attributional data in response to a cyber in2 trusion in order to identify the source of an intru3 sion; if— 

4 ‘‘(A) the program, code, or command origi5 nated on the computer of the defender but is 

6 copied or removed by an unauthorized user; and 

7 ‘‘(B) the program, code, or command does 

8 not result in the destruction of data or result 

9 in an impairment of the essential operating 

10 functionality of the attacker’s computer system, 

11 or intentionally create a backdoor enabling in12 trusive access into the attacker’s computer sys13 tem. 

14 ‘‘(2) DEFINITION.—The term ‘attributional 

15 data’ means any digital information such as log files, 

16 text strings, time stamps, malware samples, identi17 fiers such as user names and Internet Protocol ad18 dresses and metadata or other digital artifacts gath19 ered through forensic analysis.’’. 

20 SEC. 4. EXCLUSION FROM PROSECUTION FOR CERTAIN 

21 COMPUTER CRIMES FOR THOSE TAKING AC22 TIVE CYBER DEFENSE MEASURES. 

23 Section 1030 of title 18, United States Code, is 

24 amended by adding at the end the following: 


kjohnson on DSK79L0C42 with BILLS
6 

•HR 3270 IH

1 ‘‘(l) ACTIVE CYBER DEFENSE MEASURES NOT A

2 VIOLATION.— 

3 ‘‘(1) GENERALLY.—It is a defense to a criminal 

4 prosecution under this section that the conduct con5 stituting the offense was an active cyber defense 

6 measure. 

7 ‘‘(2) INAPPLICABILITY TO CIVIL ACTION.—The 

8 defense against prosecution created by this section 

9 does not prevent a United States person or entity 

10 who is targeted by an active defense measure from 

11 seeking a civil remedy, including compensatory dam12 ages or injunctive relief pursuant to subsection (g). 

13 ‘‘(3) DEFINITIONS.—In this subsection— 

14 ‘‘(A) the term ‘defender’ means a person 

15 or an entity that is a victim of a persistent un16 authorized intrusion of the individual entity’s 

17 computer; 

18 ‘‘(B) the term ‘active cyber defense meas19 ure’— 

20 ‘‘(i) means any measure— 

21 ‘‘(I) undertaken by, or at the di22 rection of, a defender; and 

23 ‘‘(II) consisting of accessing 

24 without authorization the computer of 

25 the attacker to the defender’s own 


kjohnson on DSK79L0C42 with BILLS
7 

•HR 3270 IH

1 network to gather information in 

2 order to— 

3 ‘‘(aa) establish attribution of 

4 criminal activity to share with 

5 law enforcement and other 

6 United States Government agen7 cies responsible for cybersecurity; 

8 ‘‘(bb) disrupt continued un9 authorized activity against the 

10 defender’s own network; or 

11 ‘‘(cc) monitor the behavior 

12 of an attacker to assist in devel13 oping future intrusion prevention 

14 or cyber defense techniques; but 

15 ‘‘(ii) does not include conduct that— 

16 ‘‘(I) intentionally destroys or ren17 ders inoperable information that does 

18 not belong to the victim that is stored 

19 on another person or entity’s com20 puter; 

21 ‘‘(II) recklessly causes physical 

22 injury or financial loss as described 

23 under subsection (c)(4); 

24 ‘‘(III) creates a threat to the 

25 public health or safety; 


kjohnson on DSK79L0C42 with BILLS
8 

•HR 3270 IH

1 ‘‘(IV) intentionally exceeds the 

2 level of activity required to perform 

3 reconnaissance on an intermediary 

4 computer to allow for attribution of 

5 the origin of the persistent cyber in6 trusion; 

7 ‘‘(V) intentionally results in in8 trusive or remote access into an 

9 intermediary’s computer; 

10 ‘‘(VI) intentionally results in the 

11 persistent disruption to a person or 

12 entities internet connectivity resulting 

13 in damages defined under subsection 

14 (c)(4); or 

15 ‘‘(VII) impacts any computer de16 scribed under subsection (a)(1) re17 garding access to national security in18 formation, subsection (a)(3) regarding 

19 government computers, or to sub20 section (c)(4)(A)(i)(V) regarding a 

21 computer system used by or for a 

22 Government entity for the furtherance 

23 of the administration of justice, na24 tional defense, or national security; 


kjohnson on DSK79L0C42 with BILLS
9 

•HR 3270 IH

1 ‘‘(C) the term ‘attacker’ means a person or 

2 an entity that is the source of the persistent un3 authorized intrusion into the victim’s computer; 

4 and 

5 ‘‘(D) the term ‘intermediary computer’ 

6 means a person or entity’s computer that is not 

7 under the ownership or primary control of the 

8 attacker but has been used to launch or obscure 

9 the origin of the persistent cyber-attack.’’. 

10 SEC. 5. NOTIFICATION REQUIREMENT FOR THE USE OF AC11 TIVE CYBER DEFENSE MEASURES. 

12 Section 1030 of title 18, United States Code, is 

13 amended by adding the following: 

14 ‘‘(m) NOTIFICATION REQUIREMENT FOR THE USE

15 OF ACTIVE CYBER DEFENSE MEASURES.— 

16 ‘‘(1) GENERALLY.—A defender who uses an ac17 tive cyber defense measure under the preceding sec18 tion must notify the FBI National Cyber Investiga19 tive Joint Task Force and receive a response from 

20 the FBI acknowledging receipt of the notification 

21 prior to using the measure. 

22 ‘‘(2) REQUIRED INFORMATION.—Notification 

23 must include the type of cyber breach that the per24 son or entity was a victim of, the intended target of 

25 the active cyber defense measure, the steps the deVerDate Sep 11 2014 04:22 Jun 18, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H3270.IH H3270

kjohnson on DSK79L0C42 with BILLS
10 

•HR 3270 IH

1 fender plans to take to preserve evidence of the 

2 attacker’s criminal cyber intrusion, as well as the 

3 steps they plan to prevent damage to intermediary 

4 computers not under the ownership of the attacker 

5 and other information requested by the FBI to as6 sist with oversight.’’. 

7 SEC. 6. VOLUNTARY PREEMPTIVE REVIEW OF ACTIVE 

8 CYBER DEFENSE MEASURES. 

9 (a) PILOT PROGRAM.—The Federal Bureau of Inves10 tigation (hereinafter in this section referred to as the 

11 ‘‘FBI’’), in coordination with other Federal agencies, shall 

12 create a pilot program to last for 2 years after the date 

13 of enactment of this Act, to allow for a voluntary preemp14 tive review of active defense measures. 

15 (b) ADVANCE REVIEW.—A defender who intends to 

16 prepare an active defense measure under section 4 may 

17 submit their notification to the FBI National Cyber Inves18 tigative Joint Task Force in advance of its use so that 

19 the FBI and other agencies can review the notification and 

20 provide its assessment on how the proposed active defense 

21 measure may be amended to better conform to Federal 

22 law, the terms of section 4, and improve the technical op23 eration of the measure. 


kjohnson on DSK79L0C42 with BILLS
11 

•HR 3270 IH

1 (c) PRIORITIZATION OF REQUESTS.—The FBI may 

2 decide how to prioritize the issuance of such guidance to 

3 defenders based on the availability of resources. 

4 SEC. 7. ANNUAL REPORT ON THE FEDERAL GOVERNMENT’S 

5 PROGRESS IN DETERRING CYBER FRAUD 

6 AND CYBER-ENABLED CRIMES. 

7 The Department of Justice, after consultation with 

8 the Department of Homeland Security and other relevant 

9 Federal agencies, shall deliver an annual report to Con10 gress not later than March 31 of each year, detailing the 

11 results of law enforcement activities pertaining to 

12 cybercriminal deterrence for the previous calendar year. 

13 The report shall include— 

14 (1) the number of computer fraud cases re15 ported by United States citizens and United States 

16 businesses to FBI Field Offices, the Secret Service 

17 Electronic Crimes Task Force, the Internet Crimes 

18 Complaint Center (IC3) website, and other Federal 

19 law enforcement agencies; 

20 (2) the number of investigations opened as a re21 sult of public reporting of computer fraud crimes, 

22 and the number of investigations open independently 

23 of any specific crimes being reported; 

24 (3) the number of cyber fraud cases prosecuted 

25 under section 1030 of title 18, United States Code, 


kjohnson on DSK79L0C42 with BILLS
12 

•HR 3270 IH

1 and other related statutes involving cybercrime, in2 cluding the resolution of the cases; 

3 (4) the number of computer fraud crimes deter4 mined to have originated from United States sus5 pects and the number determined to have originated 

6 from foreign suspects, and details of the country of 

7 origin of the suspected foreign suspects; 

8 (5) the number of dark web cybercriminal mar9 ketplaces and cybercriminal networks disabled by 

10 law enforcement activities; 

11 (6) an estimate of the total financial damages 

12 suffered by United States citizens and businesses re13 sulting from ransomware and other fraudulent 

14 cyberattacks; 

15 (7) the number of law enforcement personnel 

16 assigned to investigate and prosecute cybercrimes; 

17 and 

18 (8) the number of active cyber defense notifica19 tions filed as required by this Act and a comprehen20 sive evaluation of the notification process and vol21 untary preemptive review pilot program. 


kjohnson on DSK79L0C42 with BILLS
13 

•HR 3270 IH

1 SEC. 8. REQUIREMENT FOR THE DEPARTMENT OF JUSTICE 

2 TO UPDATE THE MANUAL ON THE PROSECU3 TION OF CYBERCRIMES. 

4 (a) The Department of Justice shall update the 

5 ‘‘Prosecuting Computer Crimes Manual’’ to reflect the 

6 changes made by this legislation. 

7 (b) The Department of Justice is encouraged to seek 

8 additional opportunities to clarify the manual and other 

9 guidance to the public to reflect evolving defensive tech10 niques and cyber technology that can be used in manner 

11 that does not violate section 1030 of title 18, United 

12 States Code, or other Federal law and international trea13 ties. 

14 SEC. 9. SUNSET. 

15 The exclusion from prosecution created by this Act 

16 shall expire 2 years after the date of enactment of this 

17 Act. 

Æ 


kjohnson on DSK79L0C42 with BILLS