I 

115TH CONGRESS 

2D SESSION H. R. 5576 

To address state-sponsored cyber activities against the United States, and 

for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 18, 2018 

Mr. YOHO (for himself, Mr. ROYCE of California, Mr. ENGEL, Mr. SHERMAN, 

Mr. LANGEVIN, Mr. CHABOT, Mr. POE of Texas, Mr. FITZPATRICK, Mr. 

MEADOWS, and Mr. CASTRO of Texas) introduced the following bill; 

which was referred to the Committee on Foreign Affairs, and in addition 

to the Committees on Financial Services, Oversight and Government Reform, and the Judiciary, for a period to be subsequently determined by 

the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To address state-sponsored cyber activities against the 

United States, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cyber Deterrence and 

5 Response Act of 2018’’. 

6 SEC. 2. FINDINGS. 

7 Congress finds the following: 


lotter on DSKBCFDHB2PROD with BILLS
2 

•HR 5576 IH

1 (1) On February 13, 2018, the Director of Na2 tional Intelligence stated in his testimony before the 

3 Senate Select Committee on Intelligence that ‘‘Rus4 sia, China, Iran, and North Korea will pose the 

5 greatest cyber threats to the United States during 

6 the next year’’ through the use of cyber operations 

7 as low-cost tools of statecraft, and assessed that 

8 these states would ‘‘work to use cyber operations to 

9 achieve strategic objectives unless they face clear re10 percussions for their cyber operations’’. 

11 (2) The 2017 Worldwide Threat Assessment of 

12 the United States Intelligence Community stated 

13 that ‘‘The potential for surprise in the cyber realm 

14 will increase in the next year and beyond as billions 

15 more digital devices are connected—with relatively 

16 little built-in security—and both nation states and 

17 malign actors become more emboldened and better 

18 equipped in the use of increasingly widespread cyber 

19 toolkits. The risk is growing that some adversaries 

20 will conduct cyber attacks—such as data deletion or 

21 localized and temporary disruptions of critical infra22 structure—against the United States in a crisis 

23 short of war.’’. 

24 (3) On March 29, 2017, President Donald J. 

25 Trump deemed it necessary to continue the national 


lotter on DSKBCFDHB2PROD with BILLS
3 

•HR 5576 IH

1 emergency declared in Executive Order 13694 as 

2 ‘‘Significant malicious cyber-enabled activities origi3 nating from, or directed by persons located, in whole 

4 or in substantial part, outside the United States, 

5 continue to pose an unusual and extraordinary 

6 threat to the national security, foreign policy, and 

7 economy of the United States.’’. 

8 (4) On January 5, 2017, former Director of 

9 National Intelligence, James Clapper, former Under10 secretary of Defense for Intelligence, Marcel Lettre, 

11 and the Commander of the United States Cyber 

12 Command, Admiral Michael Rogers, submitted joint 

13 testimony to the Committee on Armed Services of 

14 the Senate that stated ‘‘As of late 2016 more than 

15 30 nations are developing offensive cyber attack ca16 pabilities’’ and that ‘‘Protecting critical infrastruc17 ture, such as crucial energy, financial, manufac18 turing, transportation, communication, and health 

19 systems, will become an increasingly complex na20 tional security challenge.’’. 

21 (5) There is significant evidence that hackers 

22 affiliated with foreign governments have conducted 

23 cyber operations targeting companies and critical in24 frastructure sectors in the United States as the De25 partment of Justice has announced that— 


lotter on DSKBCFDHB2PROD with BILLS
4 

•HR 5576 IH

1 (A) on March 24, 2016, seven Iranians 

2 working for Iran’s Revolutionary Guard Corps3 affiliated entities were indicted for conducting 

4 distributed denial of service attacks against the 

5 financial sector in the United States from 2012 

6 to 2013; and 

7 (B) on May 19, 2014, five Chinese military 

8 hackers were charged for hacking United States 

9 companies in the nuclear power, metals, and 

10 solar products industries, and engaging in eco11 nomic espionage. 

12 (6) In May 2017, North Korea released 

13 ‘‘WannaCry’’ pseudo-ransomware, which posed a sig14 nificant risk to the economy, national security, and 

15 the citizens of the United States and the world, as 

16 it resulted in the infection of over 300,000 computer 

17 systems in more than 150 countries, including in the 

18 healthcare sector of the United Kingdom, dem19 onstrating the global reach and cost of cyber-enabled 

20 malicious activity. 

21 (7) In June 2017, Russia carried out the most 

22 destructive cyber-enabled operation in history, re23 leasing the NotPetya malware that caused billions of 

24 dollars’ worth of damage within Ukraine and across 

25 Europe, Asia, and the Americas. 


lotter on DSKBCFDHB2PROD with BILLS
5 

•HR 5576 IH

1 SEC. 3. ACTIONS TO ADDRESS STATE-SPONSORED CYBER 

2 ACTIVITIES AGAINST THE UNITED STATES. 

3 (a) DESIGNATION AS A CRITICAL CYBER THREAT.— 

4 (1) IN GENERAL.—The President, acting 

5 through the Secretary of State, shall designate as a 

6 critical cyber threat— 

7 (A) each foreign person and each agency 

8 or instrumentality of a foreign state that the 

9 President determines to be responsible for or 

10 complicit in, or have engaged in, directly or in11 directly, state-sponsored cyber activities that 

12 are reasonably likely to result in, or have con13 tributed to, a significant threat to the national 

14 security, foreign policy, or economic health or 

15 financial stability of the United States and that 

16 have the purpose or effect of— 

17 (i) causing a significant disruption to 

18 the availability of a computer or network 

19 of computers; 

20 (ii) harming, or otherwise significantly 

21 compromising the provision of service by, a 

22 computer or network of computers that 

23 support one or more entities in a critical 

24 infrastructure sector; 


lotter on DSKBCFDHB2PROD with BILLS
6 

•HR 5576 IH

1 (iii) significantly compromising the 

2 provision of services by one or more enti3 ties in a critical infrastructure sector; 

4 (iv) causing a significant misappro5 priation of funds or economic resources, 

6 trade secrets, personal identifiers, or finan7 cial information for commercial or competi8 tive advantage or private financial gain; 

9 (v) destabilizing the financial sector of 

10 the United States by tampering with, alter11 ing, or causing a misappropriation of data; 

12 or 

13 (vi) interfering with or undermining 

14 election processes or institutions by tam15 pering with, altering, or causing misappro16 priation of data; 

17 (B) each foreign person that the President 

18 has determined to have knowingly materially as19 sisted, sponsored, or provided financial, mate20 rial, or technological support for, or goods or 

21 services to or in support of, any activities de22 scribed in subparagraph (A) by a foreign person 

23 or agency or instrumentality of a foreign state 

24 designated as a critical cyber threat under sub25 paragraph (A); 


lotter on DSKBCFDHB2PROD with BILLS
7 

•HR 5576 IH

1 (C) each agency or instrumentality of a 

2 foreign state that the President has determined 

3 to have materially assisted, sponsored, or pro4 vided financial, material, or technological sup5 port for, or goods or services to or in support 

6 of, any activities described in subparagraph (A) 

7 by a foreign person or agency or instrumen8 tality of a foreign state designated as a critical 

9 cyber threat under subparagraph (A); 

10 (D) each foreign person that the President 

11 has determined to have attempted to engage in 

12 any of the activities described in subparagraph 

13 (A) or (B); or 

14 (E) each agency or instrumentality of a 

15 foreign state that the President has determined 

16 to have attempted to engage in any of the ac17 tivities described in subparagraph (A) or (C). 

18 (2) PUBLICATION IN FEDERAL REGISTER.—The 

19 President shall— 

20 (A) publish in the Federal Register a list 

21 of each foreign person and each agency or in22 strumentality of a foreign state designated as a 

23 critical cyber threat under this subsection; and 


lotter on DSKBCFDHB2PROD with BILLS
8 

•HR 5576 IH

1 (B) regularly update such list not later 

2 than seven days after making any changes to 

3 the list. 

4 (b) NON-TRAVEL-RELATED SANCTIONS.— 

5 (1) IN GENERAL.—The President shall impose 

6 one or more of the applicable sanctions described in 

7 paragraph (2) with respect to each foreign person 

8 and each agency or instrumentality of a foreign 

9 state designated as a critical cyber threat under sub10 section (a). 

11 (2) SANCTIONS DESCRIBED.—The sanctions de12 scribed in this paragraph are the following: 

13 (A) The President may provide for the 

14 withdrawal, limitation, or suspension of non-hu15 manitarian United States development assist16 ance under chapter 1 of part I of the Foreign 

17 Assistance Act of 1961. 

18 (B) The President may provide for the 

19 withdrawal, limitation, or suspension of United 

20 States security assistance under part II of the 

21 Foreign Assistance Act of 1961. 

22 (C) The President may direct the United 

23 States executive director to each international 

24 financial institution to use the voice and vote of 

25 the United States to oppose any loan from the 


lotter on DSKBCFDHB2PROD with BILLS
9 

•HR 5576 IH

1 international financial institution that would 

2 benefit the designated foreign person or the 

3 designated agency or instrumentality of a for4 eign state. 

5 (D) The President may direct the Export6 Import Bank of the United States, the Overseas 

7 Private Investment Corporation, or any other 

8 United States Government agency not to ap9 prove the issuance of any (or a specified num10 ber of) guarantees, insurance, extensions of 

11 credit, or participations in the extension of 

12 credit. 

13 (E) The President may, pursuant to such 

14 regulations or guidelines as the President may 

15 prescribe, prohibit any United States person 

16 from investing in or purchasing significant 

17 amounts of equity or debt instruments of the 

18 designated foreign person or the designated 

19 agency or instrumentality of a foreign state. 

20 (F) The President may, pursuant to such 

21 regulations or guidelines as the President may 

22 prescribe, prohibit any United States agency or 

23 instrumentality from procuring, or entering into 

24 any contract for the procurement of, any goods, 

25 technology, or services, or classes of goods, 


lotter on DSKBCFDHB2PROD with BILLS
10 

•HR 5576 IH

1 technology, or services, from the designated for2 eign person or the designated agency or instru3 mentality of a foreign state. 

4 (G) The President may order the heads of 

5 the appropriate United States agencies to not 

6 issue any (or a specified number of) specific li7 censes, and to not grant any other specific au8 thority (or a specified number of authorities), to 

9 export any goods or technology to the des10 ignated foreign person or the designated agency 

11 or instrumentality of a foreign state under— 

12 (i) the Export Administration Act of 

13 1979 (as continued in effect pursuant the 

14 International Emergency Economic Powers 

15 Act); 

16 (ii) the Arms Export Control Act; 

17 (iii) the Atomic Energy Act of 1954; 

18 or 

19 (iv) any other statute that requires 

20 the prior review and approval of the 

21 United States Government as a condition 

22 for the export or re-export of goods or 

23 services. 

24 (H)(i) The President may exercise all of 

25 the powers granted to the President under the 


lotter on DSKBCFDHB2PROD with BILLS
11 

•HR 5576 IH

1 International Emergency Economic Powers Act 

2 (50 U.S.C. 1701 et seq.) (except that the re3 quirements of section 202 of such Act (50 

4 U.S.C. 1701) shall not apply) to the extent nec5 essary to block and prohibit all transactions in 

6 property and interests in property of the des7 ignated foreign person if such property and in8 terests in property are in the United States, 

9 come within the United States, or are or come 

10 within the possession or control of a United 

11 States person. 

12 (ii) The penalties provided for in sub13 sections (b) and (c) of section 206 of the Inter14 national Emergency Economic Powers Act (50 

15 U.S.C. 1705) shall apply to a person that vio16 lates, attempts to violate, conspires to violate, 

17 or causes a violation of regulations prescribed 

18 under clause (i) to the same extent that such 

19 penalties apply to a person that commits an un20 lawful act described in subsection (a) of such 

21 section 206. 

22 (I) The President may, pursuant to such 

23 regulations as the President may prescribe, pro24 hibit any transfers of credit or payments be25 tween one or more financial institutions or by, 


lotter on DSKBCFDHB2PROD with BILLS
12 

•HR 5576 IH

1 through, or to any financial institution, to the 

2 extent that such transfers or payments are sub3 ject to the jurisdiction of the United States and 

4 involve any interest of the designated foreign 

5 person. 

6 (c) TRAVEL-RELATED SANCTIONS.— 

7 (1) ALIENS INELIGIBLE FOR VISAS, ADMISSION, 

8 OR PAROLE.—An alien who is designated as a crit9 ical cyber threat under subsection (a) is— 

10 (A) inadmissible to the United States; 

11 (B) ineligible to receive a visa or other doc12 umentation to enter the United States; and 

13 (C) otherwise ineligible to be admitted or 

14 paroled into the United States or to receive any 

15 other benefit under the Immigration and Na16 tionality Act (8 U.S.C. 1101 et seq.). 

17 (2) CURRENT VISAS REVOKED.—The issuing 

18 consular officer, the Secretary of State, or the Sec19 retary of Homeland Security (or a designee of either 

20 such Secretaries) shall revoke any visa or other 

21 entry documentation issued to the foreign person 

22 designated as a critical cyber threat under sub23 section (a) regardless of when issued. A revocation 

24 under this clause shall take effect immediately and 

25 shall automatically cancel any other valid visa or 


lotter on DSKBCFDHB2PROD with BILLS
13 

•HR 5576 IH

1 entry documentation that is in the possession of 

2 such foreign person. 

3 (d) ADDITIONAL SANCTIONS WITH RESPECT TO

4 FOREIGN STATES.— 

5 (1) IN GENERAL.—The President may impose 

6 any of the sanctions described in paragraph (2) with 

7 respect to the government of each foreign state that 

8 the President has determined aided, abetted, or di9 rected a foreign person or agency or instrumentality 

10 of a foreign state designated as a critical cyber 

11 threat under subsection (a). 

12 (2) SANCTIONS DESCRIBED.—The sanctions re13 ferred to in paragraph (1) are the following: 

14 (A) The President may provide for the 

15 withdrawal, limitation, or suspension of non-hu16 manitarian or non-trade-related assistance 

17 United States development assistance under 

18 chapter 1 of part I of the Foreign Assistance 

19 Act of 1961. 

20 (B) The President may provide for the 

21 withdrawal, limitation, or suspension of United 

22 States security assistance under part II of the 

23 Foreign Assistance Act of 1961. 

24 (C) The President may instruct the United 

25 States Executive Director to each appropriate 


lotter on DSKBCFDHB2PROD with BILLS
14 

•HR 5576 IH

1 international financial institution to oppose, and 

2 vote against the extension by such institution of 

3 any loan or financial or technical assistance to 

4 the government of the foreign state. 

5 (D) No item on the United States Muni6 tions List (established pursuant to section 38 of 

7 the Arms Export Control Act (22 U.S.C. 

8 2778)) or the Commerce Control List set forth 

9 in Supplement No. 1 to part 774 of title 15, 

10 Code of Federal Regulations, may be exported 

11 to the government of the foreign state. 

12 (E) The President may, pursuant to such 

13 regulations as the President may prescribe, pro14 hibit any transactions in foreign exchange that 

15 are subject to the jurisdiction of the United 

16 States and in which the government of the for17 eign state has any interest. 

18 (F) The President may, pursuant to such 

19 regulations as the President may prescribe, pro20 hibit any transfers of credit or payments be21 tween one or more financial institutions or by, 

22 through, or to any financial institution, to the 

23 extent that such transfers or payments are sub24 ject to the jurisdiction of the United States and 


lotter on DSKBCFDHB2PROD with BILLS
15 

•HR 5576 IH

1 involve any interest of the government of the 

2 foreign state. 

3 (e) EXEMPTIONS, WAIVERS, AND REMOVALS OF

4 SANCTIONS AND DESIGNATIONS.— 

5 (1) EXEMPTIONS.— 

6 (A) MANDATORY EXEMPTIONS.—The fol7 lowing activities shall be exempt from sanctions 

8 under subsections (b), (c), and (d): 

9 (i) Activities subject to the reporting 

10 requirements of title V of the National Se11 curity Act of 1947 (50 U.S.C. 413 et seq.), 

12 or to any authorized intelligence activities 

13 of the United States. 

14 (ii) Any transaction necessary to com15 ply with United States obligations under 

16 the Agreement between the United Nations 

17 and the United States of America regard18 ing the Headquarters of the United Na19 tions, signed June 26, 1947, and entered 

20 into force on November 21, 1947, or under 

21 the Vienna Convention on Consular Rela22 tions, signed April 24, 1963, and entered 

23 into force on March 19, 1967, or under 

24 other international agreements. 


lotter on DSKBCFDHB2PROD with BILLS
16 

•HR 5576 IH

1 (2) WAIVER.—The President may waive, on a 

2 case-by-case basis, the imposition of sanctions for a 

3 period of not more than one year, and may renew 

4 that waiver for additional periods of not more than 

5 one year, any sanction or penalty under this section 

6 if the President submits to the appropriate congres7 sional committees a written determination that the 

8 waiver meets one or more of the following require9 ments: 

10 (A) The waiver is important to the eco11 nomic or national security interests of the 

12 United States. 

13 (B) The waiver will further the enforce14 ment of this Act or is for an important law en15 forcement purpose. 

16 (C) The waiver is for an important human17 itarian purpose. 

18 (3) REMOVALS OF SANCTIONS AND DESIGNA19 TIONS.—The President may prescribe rules and reg20 ulations for the removal of sanctions under sub21 sections (b), (c), and (d) and the removal of designa22 tions under subsection (a) if the President deter23 mines that a foreign person, agency or instrumen24 tality of a foreign state, or government of a foreign 

25 state subject to such sanctions, as the case may be, 


lotter on DSKBCFDHB2PROD with BILLS
17 

•HR 5576 IH

1 has verifiably ceased its participation in any of the 

2 conduct with respect to which the foreign person, 

3 agency or instrumentality of a foreign state, or gov4 ernment of a foreign state, as the case may be, was 

5 subject to sanctions under this section and has given 

6 assurances that it will no longer participate in such 

7 conduct. 

8 (4) EXCEPTION TO COMPLY WITH UNITED NA9 TIONS HEADQUARTERS AGREEMENT.—Sanctions 

10 under subsection (c) shall not apply to a foreign per11 son if admitting the foreign person into the United 

12 States is necessary to permit the United States to 

13 comply with the Agreement regarding the Head14 quarters of the United Nations, signed at Lake Suc15 cess June 26, 1947, and entered into force Novem16 ber 21, 1947, between the United Nations and the 

17 United States, or other applicable international obli18 gations. 

19 (f) BRIEFING TO CONGRESS.— 

20 (1) IN GENERAL.—Not later than 180 days 

21 after the date of the enactment of this section, and 

22 periodically thereafter, the President shall provide to 

23 the appropriate congressional committees a briefing 

24 on state-sponsored cyber activities against the 

25 United States. 


lotter on DSKBCFDHB2PROD with BILLS
18 

•HR 5576 IH

1 (2) MATTERS TO BE INCLUDED.—The briefing 

2 required by paragraph (1) shall, include the fol3 lowing, to the extent the information is available: 

4 (A) A list of foreign states that continue to 

5 aid, abet, or direct any foreign person or agency 

6 or instrumentality of a foreign state to carry 

7 out state-sponsored cyber activities against the 

8 United States, including— 

9 (i) a list of entities within the United 

10 States critical infrastructure that are be11 lieved to have been, or are currently still, 

12 subject to state-sponsored cyber activities 

13 by each such foreign state; and 

14 (ii) a list of such foreign persons and 

15 agencies and instrumentalities of foreign 

16 states that the President has reason to be17 lieve are engaging, or have engaged in, 

18 state-sponsored cyber activities against the 

19 United States but are not currently des20 ignated under subsection (b). 

21 (B) A list of the foreign persons and agen22 cies and instrumentalities of foreign states with 

23 respect to which the imposition of sanctions 

24 were waived or removed under subsection (f). 


lotter on DSKBCFDHB2PROD with BILLS
19 

•HR 5576 IH

1 (C) A summary of any efforts made by the 

2 Government of the United States to resolve and 

3 bring an immediate end to state-sponsored 

4 cyber activities against the United States that 

5 could result in the designation as a critical 

6 cyber threat under subsection (a). 

7 (g) DEFINITIONS.—In this section: 

8 (1) ADMITTED; ALIEN.—The terms ‘‘admitted’’ 

9 and ‘‘alien’’ have the meanings given such terms in 

10 section 101 of the Immigration and Nationality Act 

11 (8 U.S.C. 1101). 

12 (2) APPROPRIATE CONGRESSIONAL COMMIT13 TEES.—The term ‘‘appropriate congressional com14 mittees’’ means— 

15 (A) the Committee on Foreign Affairs, the 

16 Committee on Financial Services, the Com17 mittee on the Judiciary, the Committee on 

18 Oversight and Government Reform, and the 

19 Committee on Homeland Security of the House 

20 of Representatives; and 

21 (B) the Committee on Foreign Relations, 

22 the Committee on Banking, Housing, and 

23 Urban Affairs, the Committee on the Judiciary, 

24 and the Committee on Homeland Security and 

25 Governmental Affairs of the Senate. 


lotter on DSKBCFDHB2PROD with BILLS
20 

•HR 5576 IH

1 (3) AGENCY OR INSTRUMENTALITY OF A FOR2 EIGN STATE.—The term ‘‘agency or instrumentality 

3 of a foreign state’’ has the meaning given such term 

4 in section 1603(b) of title 28, United States Code. 

5 (4) CRITICAL INFRASTRUCTURE SECTOR.—The 

6 term ‘‘critical infrastructure sector’’ means any of 

7 the designated critical infrastructure sectors identi8 fied in the Presidential Policy Directive entitled 

9 ‘‘Critical Infrastructure Security and Resilience’’, 

10 numbered 21, and dated February 12, 2013. 

11 (5) FOREIGN PERSON.—The term ‘‘foreign per12 son’’ means— 

13 (A) an individual who is not a United 

14 States citizen or an alien lawfully admitted for 

15 permanent residence to the United States; or 

16 (B) an entity that is not a United States 

17 person. 

18 (6) FOREIGN STATE.—The term ‘‘foreign state’’ 

19 has the meaning given such term in section 1603(a) 

20 of title 28, United States Code. 

21 (7) KNOWINGLY.—The term ‘‘knowingly’’, with 

22 respect to conduct, a circumstance, or a result, 

23 means that a person has actual knowledge, or should 

24 have known, of the conduct, the circumstance, or the 

25 result. 


lotter on DSKBCFDHB2PROD with BILLS
21 

•HR 5576 IH

1 (8) MISAPPROPRIATION.—The term ‘‘misappro2 priation’’ means taking or obtaining by improper 

3 means, without permission or consent, or under false 

4 pretenses. 

5 (9) STATE-SPONSORED CYBER ACTIVITIES.— 

6 The term ‘‘state-sponsored cyber activities’’ means 

7 any cyber-enabled activities that— 

8 (A) are carried out by an agency or instru9 mentality of a foreign state; or 

10 (B) are carried out by a foreign person 

11 that is aided, abetted, or directed by a foreign 

12 state or an agency or instrumentality of a for13 eign state. 

14 (10) UNITED STATES PERSON.—The term 

15 ‘‘United States person’’ means— 

16 (A) a United States citizen or an alien law17 fully admitted for permanent residence to the 

18 United States; or 

19 (B) an entity organized under the laws of 

20 the United States or of any jurisdiction within 

21 the United States, including a foreign branch of 

22 such an entity. 

Æ 


lotter on DSKBCFDHB2PROD with BILLS