network to gather information in 
order to— 
‘‘(aa) establish attribution of 
criminal activity to share with 
law 
enforcement 
and 
other 
United States Government agen-
cies responsible for cybersecurity; 
‘‘(bb) disrupt continued un-
authorized activity against the 
defender’s own network; or 
‘‘(cc) monitor the behavior 
of an attacker to assist in devel-
oping future intrusion prevention 
or cyber defense techniques; but 
‘‘(ii) does not include conduct that— 
‘‘(I) intentionally destroys or ren-
ders inoperable information that does 
not belong to the victim that is stored 
on another person or entity’s com-
puter; 
‘‘(II) recklessly causes physical 
injury or financial loss as described 
under subsection (c)(4); 
‘‘(III) creates a threat to the 
public health or safety; 
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
‘‘(IV) intentionally exceeds the 
level of activity required to perform 
reconnaissance on an intermediary 
computer to allow for attribution of 
the origin of the persistent cyber in-
trusion; 
‘‘(V) intentionally results in in-
trusive or remote access into an 
intermediary’s computer; 
‘‘(VI) intentionally results in the 
persistent disruption to a person or 
entities internet connectivity resulting 
in damages defined under subsection 
(c)(4); or 
‘‘(VII) impacts any computer de-
scribed under subsection (a)(1) re-
garding access to national security in-
formation, subsection (a)(3) regarding 
government computers, or to sub-
section (c)(4)(A)(i)(V) regarding a 
computer system used by or for a 
Government entity for the furtherance 
of the administration of justice, na-
tional defense, or national security; 
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
‘‘(C) the term ‘attacker’ means a person or 
an entity that is the source of the persistent un-
authorized intrusion into the victim’s computer; 
and 
‘‘(D) the term ‘intermediary computer’ 
means a person or entity’s computer that is not 
under the ownership or primary control of the 
attacker but has been used to launch or obscure 
the origin of the persistent cyber-attack.’’. 
SEC. 5. NOTIFICATION REQUIREMENT FOR THE USE OF AC-
TIVE CYBER DEFENSE MEASURES. 
Section 1030 of title 18, United States Code, is 
amended by adding the following: 
‘‘(m) NOTIFICATION REQUIREMENT FOR THE USE 
OF ACTIVE CYBER DEFENSE MEASURES.— 
‘‘(1) GENERALLY.—A defender who uses an ac-
tive cyber defense measure under the preceding sec-
tion must notify the FBI National Cyber Investiga-
tive Joint Task Force and receive a response from 
the FBI acknowledging receipt of the notification 
prior to using the measure. 
‘‘(2) REQUIRED
INFORMATION.—Notification 
must include the type of cyber breach that the per-
son or entity was a victim of, the intended target of 
the active cyber defense measure, the steps the de-
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
fender plans to take to preserve evidence of the 
attacker’s criminal cyber intrusion, as well as the 
steps they plan to prevent damage to intermediary 
computers not under the ownership of the attacker 
and other information requested by the FBI to as-
sist with oversight.’’. 
SEC. 6. VOLUNTARY PREEMPTIVE REVIEW OF ACTIVE 
CYBER DEFENSE MEASURES. 
(a) PILOT PROGRAM.—The Federal Bureau of Inves-
tigation (hereinafter in this section referred to as the 
‘‘FBI’’), in coordination with other Federal agencies, shall 
create a pilot program to last for 2 years after the date 
of enactment of this Act, to allow for a voluntary preemp-
tive review of active defense measures. 
(b) ADVANCE REVIEW.—A defender who intends to 
prepare an active defense measure under section 4 may 
submit their notification to the FBI National Cyber Inves-
tigative Joint Task Force in advance of its use so that 
the FBI and other agencies can review the notification and 
provide its assessment on how the proposed active defense 
measure may be amended to better conform to Federal 
law, the terms of section 4, and improve the technical op-
eration of the measure. 
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
(c) PRIORITIZATION OF REQUESTS.—The FBI may 
decide how to prioritize the issuance of such guidance to 
defenders based on the availability of resources. 
SEC. 7. ANNUAL REPORT ON THE FEDERAL GOVERNMENT’S 
PROGRESS IN DETERRING CYBER FRAUD 
AND CYBER-ENABLED CRIMES. 
The Department of Justice, after consultation with 
the Department of Homeland Security and other relevant 
Federal agencies, shall deliver an annual report to Con-
gress not later than March 31 of each year, detailing the 
results of law enforcement activities pertaining to 
cybercriminal deterrence for the previous calendar year. 
The report shall include— 
(1) the number of computer fraud cases re-
ported by United States citizens and United States 
businesses to FBI Field Offices, the Secret Service 
Electronic Crimes Task Force, the Internet Crimes 
Complaint Center (IC3) website, and other Federal 
law enforcement agencies; 
(2) the number of investigations opened as a re-
sult of public reporting of computer fraud crimes, 
and the number of investigations open independently 
of any specific crimes being reported; 
(3) the number of cyber fraud cases prosecuted 
under section 1030 of title 18, United States Code, 
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
and other related statutes involving cybercrime, in-
cluding the resolution of the cases; 
(4) the number of computer fraud crimes deter-
mined to have originated from United States sus-
pects and the number determined to have originated 
from foreign suspects, and details of the country of 
origin of the suspected foreign suspects; 
(5) the number of dark web cybercriminal mar-
ketplaces and cybercriminal networks disabled by 
law enforcement activities; 
(6) an estimate of the total financial damages 
suffered by United States citizens and businesses re-
sulting from ransomware and other fraudulent 
cyberattacks; 
(7) the number of law enforcement personnel 
assigned to investigate and prosecute cybercrimes; 
and 
(8) the number of active cyber defense notifica-
tions filed as required by this Act and a comprehen-
sive evaluation of the notification process and vol-
untary preemptive review pilot program. 
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
SEC. 8. REQUIREMENT FOR THE DEPARTMENT OF JUSTICE 
TO UPDATE THE MANUAL ON THE PROSECU-
TION OF CYBERCRIMES. 
(a) The Department of Justice shall update the 
‘‘Prosecuting Computer Crimes Manual’’ to reflect the 
changes made by this legislation. 
(b) The Department of Justice is encouraged to seek 
additional opportunities to clarify the manual and other 
guidance to the public to reflect evolving defensive tech-
niques and cyber technology that can be used in manner 
that does not violate section 1030 of title 18, United 
States Code, or other Federal law and international trea-
ties. 
SEC. 9. SUNSET. 
The exclusion from prosecution created by this Act 
shall expire 2 years after the date of enactment of this 
Act. 
Æ 
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6301
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS