Cyber Deterrence and Response Act of 2022

To impose sanctions with respect to designated critical cyber threat actors, and for other purposes. 1. Short title This Act may be cited as the Cyber Deterrence and Response Act of 2022 2. Actions to address state-sponsored cyber activities against the United States (a) Designation as a critical cyber threat actor (1) In general The President, acting through the Secretary of State, and in coordination with the heads of other relevant Federal departments and agencies, shall designate as a critical cyber threat actor— (A) each foreign person and each agency or instrumentality of a foreign state that the President determines to be knowingly responsible for or complicit in, or have engaged in, directly or indirectly, state-sponsored cyber activities originating from, or directed by persons located, in whole or in substantial part, outside the United States that are reasonably likely to result in, or have contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States and that have the purpose or effect of— (i) causing a significant disruption to the availability of a computer or network of computers; (ii) harming, or otherwise significantly compromising the provision of service by, a computer or network of computers that support one or more entities in a critical infrastructure sector; (iii) significantly compromising the provision of services by one or more entities in a critical infrastructure sector; (iv) causing a significant misappropriation of funds or economic resources, trade secrets, personal identifiers, health or financial information for commercial or competitive advantage or private financial gain; (v) destabilizing the financial sector of the United States by tampering with, altering, or causing a misappropriation of data; (vi) causing a significant disruption to the energy sector of the United States by tampering with or altering data or equipment necessary for the operation of the energy sector in the United States; or (vii) interfering with or undermining election processes or government institutions by tampering with, altering, or causing misappropriation of data; (B) each foreign person that the President has determined to have knowingly, significantly, and materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, any activities described in subparagraph (A) by a foreign person or agency or instrumentality of a foreign state designated as a critical cyber threat actor under subparagraph (A); (C) each agency or instrumentality of a foreign state that the President has determined to have significantly and materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, any activities described in subparagraph (A) by a foreign person or agency or instrumentality of a foreign state designated as a critical cyber threat actor under subparagraph (A); and (D) any person determined by the President to be responsible for or complicit in, or to have engaged in, the receipt or use for commercial or competitive advantage or private financial gain, or by a commercial entity, outside the United States of data or information, including trade secrets, misappropriated through cyber-enabled means, knowing they have been misappropriated, where the misappropriation of such trade secrets is reasonably likely to result in, or has materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States or personal safety of American citizens. (2) Transmission to congress Not later than 7 calendar days after designating a foreign person or agency or instrumentality of a foreign state as a critical cyber threat actor under paragraph (1), the President shall transmit to the appropriate congressional committees in classified or unclassified form a report identifying the designee. (b) Non-Travel-Related sanctions (1) In general The President shall impose one or more of the applicable sanctions described in paragraph (2) with respect to each foreign person and each agency or instrumentality of a foreign state designated as a critical cyber threat actor under subsection (a). (2) Sanctions described The sanctions described in this paragraph are the following: (A) The President may provide for the withdrawal, limitation, or suspension of non-humanitarian United States development assistance under chapter 1 of part I of the Foreign Assistance Act of 1961 ( 22 U.S.C. 2151 et seq. (B) The President may provide for the withdrawal, limitation, or suspension of United States security assistance under part II of the Foreign Assistance Act of 1961 ( 22 U.S.C. 2301 et seq. (C) The President may direct the United States executive director to each international financial institution to use the voice and vote of the United States to oppose any loan from the international financial institution that would benefit the designated foreign person or the designated agency or instrumentality of a foreign state. (D) The President may direct the United States International Development Finance Corporation, or any other United States Government agency not to approve the issuance of any (or a specified number of) guarantees, insurance, extensions of credit, or participation in the extension of credit. (E) The President may, pursuant to such regulations or guidelines as the President may prescribe, prohibit any United States person from purchasing or selling any publicly traded securities, or any publicly traded securities that are derivative of such securities or are designed to provide investment exposure to such securities or investing in or purchasing significant amounts of equity or debt instruments of the designated foreign person. (F) The President may, pursuant to procedures the President shall prescribe, which shall include the opportunity to appeal actions under this subparagraph, prohibit any United States agency or instrumentality from procuring, or entering into any contract for the procurement of, any goods, technology, or services, or classes of goods, technology, or services, from the designated foreign person or the designated agency or instrumentality of a foreign state. (G) The President may terminate— (i) sales to that country under the Arms Export Control Act ( 22 U.S.C. 2751 et seq. (ii) sales to that country of any item on the United States Munitions List maintained pursuant to part 121 of title 22, Code of Federal Regulations. (H) The President may prohibit the entity and, when acting for or on the entity’s behalf, its successors, assigns, directors, officers, employees, representatives, or agents, from directly or indirectly participating in transactions involving any commodity, software, or technology subject to United States jurisdiction under the Export Administration Regulations ( EAR (i) applying for, obtaining, or using any license, license exception, or export control document; (ii) carrying out negotiations concerning, ordering, buying, receiving, using, selling, delivering, storing, disposing of, forwarding, transporting, financing, or servicing in any way any item exported or to be exported from the United States that is subject to the EAR; and (iii) benefitting in any way from any transaction involving any item exported or to be exported from the United States that is subject to the EAR. (I) The President may prohibit any person, whether a United States or non-United States person, from engaging in the following activities, either directly or indirectly, with the entity: (i) Exporting or reexporting to or on behalf of the entity any item subject to the EAR. (ii) Facilitating the acquisition or attempted acquisition by the entity of the ownership, possession, or control of any item subject to the EAR that has been or will be exported from the United States, including financing or other support activities related to a transaction whereby the entity acquires or attempts to acquire such ownership, possession or control. (iii) Acquiring from or facilitating the acquisition or attempted acquisition from the entity or any item subject to the EAR that has been exported from the United States. (iv) Obtaining from the entity in the United States any item subject to the EAR with knowledge or reason to know that the item will be, or is intended to be, exported from the United States. (v) Engaging in any transaction to service any item subject to the EAR that has been or will be exported from the United States and which is owned, possessed, or controlled by the entity if such service involves the use of any item subject to the EAR that has been or will be exported from the United States (for purposes of this paragraph service (J) (i) The President may exercise all of the powers granted to the President under the International Emergency Economic Powers Act ( 50 U.S.C. 1701 et seq. 50 U.S.C. 1701 (ii) The penalties provided for in subsections (b) and (c) of section 206 of the International Emergency Economic Powers Act ( 50 U.S.C. 1705 (K) The President may, pursuant to such regulations as the President may prescribe, prohibit any transfers of credit or payments between one or more financial institutions or by, through, or to any financial institution, to the extent that such transfers or payments are subject to the jurisdiction of the United States and involve any interest of the designated foreign person. (c) Travel-Related sanctions (1) Aliens ineligible for visas, admission, or parole An alien who is designated as a critical cyber threat actor under subsection (a) is— (A) inadmissible to the United States; (B) ineligible to receive a visa or other documentation to enter the United States; and (C) otherwise ineligible to be admitted or paroled into the United States or to receive any other benefit under the Immigration and Nationality Act ( 8 U.S.C. 1101 et seq. (2) Current visas revoked The issuing consular officer, the Secretary of State, or the Secretary of Homeland Security (or a designee of either such Secretaries) shall revoke any visa or other entry documentation issued to the foreign person designated as a critical cyber threat actor under subsection (a) regardless of when issued. A revocation under this clause shall take effect immediately and shall automatically cancel any other valid visa or entry documentation that is in the possession of such foreign person. (d) Additional sanctions with respect to foreign countries (1) In general The President may impose any of the sanctions described in paragraph (2) with respect to the government of each country that the President has determined aided, abetted, or directed a foreign person or agency or instrumentality of a foreign state designated as a critical cyber threat actor under subsection (a). (2) Sanctions described The sanctions referred to in paragraph (1) are the following: (A) The President may provide for the withdrawal, limitation, or suspension of non-humanitarian or non-trade-related assistance United States development assistance under chapter 1 of part I of the Foreign Assistance Act of 1961 ( 22 U.S.C. 2151 et seq. (B) The President may provide for the withdrawal, limitation, or suspension of United States security assistance under part II of the Foreign Assistance Act of 1961 ( 22 U.S.C. 2301 et seq. (C) The President may instruct the United States Executive Director to each appropriate international financial institution to oppose, and vote against the extension by such institution of any loan or financial assistance to the government of the country. (D) No item on the United States Munitions List (maintained pursuant to part 121 of title 22, Code of Federal Regulations) or the Commerce Control List set forth in Supplement No. 1 to part 774 of title 15, Code of Federal Regulations, may be exported to the government of the country or any entity under its influence, control, or ownership. (E) (i) No intrusion software or IP network communications surveillance systems or related items that are subject to the Export Administration Regulations, whether or not enumerated on the Commerce Control List, may be exported, reexported, or transferred, directly or indirectly, to the government of the country or any entity under its influence, control, or ownership. (ii) For purposes of this subparagraph, the terms intrusion software IP network communications (I) systems, equipment, or components specially designed for the generation, operation or delivery of, or communication with, with intrusion software; (II) software specially designed or modified for the development or production of such systems, equipment or components; (III) software specially designed for the generation, operation or delivery of, or communication with, intrusion software; technology required for the development of intrusion software; and (IV) internet protocol network communications surveillance systems or equipment and test, inspection, production equipment, specially designed components therefor, and development and production software and technology therefor. (e) Implementation The President may exercise all authorities provided under sections 203 and 205 of the International Emergency Economic Powers Act (50 U.S.C. 1702 and 1704) to carry out this section. (f) Coordination To the extent practicable— (1) actions taken by the President pursuant to this section should be coordinated with United States allies and partners; and (2) the Secretary of State should work with United States allies and partners, on a voluntary basis, to lead an international diplomatic initiative to— (A) deter critical cyber threat actors and state-sponsored cyber activities; and (B) provide mutual support to such allies and partners participating in such initiative to respond to such state-sponsored cyber activities. (g) Exemptions, waivers, and removals of sanctions and designations (1) Mandatory exemptions Activities subject to the reporting requirements of title V of the National Security Act of 1947 ( 50 U.S.C. 413 et seq. (2) Waiver The President may waive, on a case-by-case basis, the imposition of sanctions described in this section for a period of not more than 1 year, and may renew such waiver for additional periods of not more than 1 year, if the President transmits to the appropriate congressional committees a written determination that such waiver meets one or more of the following requirements: (A) Such waiver is in the national interests of the United States. (B) Such waiver will further the enforcement of this Act or is for an important law enforcement purpose. (C) Such waiver is for an important humanitarian purpose. (3) Removals of sanctions and designations The President may prescribe rules and regulations for the removal of sanctions under subsections (b), (c), and (d) and the removal of designations under subsection (a) if the President determines that a foreign person, agency or instrumentality of a foreign state, or government of a country subject to such sanctions or such designations, as the case may be, has verifiably ceased its participation in any of the conduct with respect to which such foreign person, agency or instrumentality of a foreign state, or government was subject to such sanctions or designation, as the case may be, under this section, and has given assurances that such foreign person, agency or instrumentality of a foreign state, or government, as the case may be, will no longer participate in such conduct. (4) Exception to comply with united nations headquarters agreement Sanctions under subsection (c) shall not apply to a foreign person if admitting such foreign person into the United States is necessary to permit the United States to comply with the Agreement regarding the Headquarters of the United Nations, signed at Lake Success June 26, 1947, and entered into force November 21, 1947, between the United Nations and the United States, or other applicable international obligations. (h) Rule of construction Nothing in this section may be construed to limit the authority of the President under the International Emergency Economic Powers Act ( 50 U.S.C. 1701 et seq. (i) Definitions In this section: (1) Admitted; alien The terms admitted alien 8 U.S.C. 1101 (2) Appropriate congressional committees The term appropriate congressional committees (A) the Committee on Foreign Affairs, the Committee on Financial Services, the Committee on the Judiciary, the Committee on Oversight and Reform, and the Committee on Homeland Security of the House of Representatives; and (B) the Committee on Foreign Relations, the Committee on Banking, Housing, and Urban Affairs, the Committee on the Judiciary, and the Committee on Homeland Security and Governmental Affairs of the Senate. (3) Agency or instrumentality of a foreign state The term agency or instrumentality of a foreign state (4) Critical infrastructure sector The term critical infrastructure sector Critical Infrastructure Security and Resilience (5) Foreign person The term foreign person (6) Foreign state The term foreign state (7) Knowingly The term knowingly (8) Misappropriation The term misappropriation (9) State-sponsored cyber activities The term state-sponsored cyber activities (A) are carried out by a government of a foreign country or an agency or instrumentality of a foreign state; or (B) are carried out by a foreign person that is aided, abetted, or directed by a government of a foreign country or an agency or instrumentality of a foreign state. (10) United states person The term United States person (A) a United States citizen or an alien lawfully admitted for permanent residence to the United States; or (B) an entity organized under the laws of the United States or of any jurisdiction within the United States, including a foreign branch of such an entity.

Summary: Cyber Deterrence and Response Act of 2022 This bill imposes sanctions on foreign persons (individuals or entities, including agencies of a foreign state) that are knowingly responsible for or have engaged in certain state-sponsored cyber activities, generally those that originate from outside of the United States and are reasonably likely to contribute to a significant threat to U.S. national security, foreign policy, economic health, or financial stability. The bill also imposes sanctions on certain foreign persons that provide material support for such state-sponsored cyber activities.