IB 
Union Calendar No. 61 
114TH CONGRESS 
1ST SESSION H. R. 1731 
[Report No. 114–83] 
To amend the Homeland Security Act of 2002 to enhance multi-directional 
sharing of information related to cybersecurity risks and strengthen 
privacy and civil liberties protections, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 13, 2015 
Mr. MCCAUL (for himself and Mr. RATCLIFFE) introduced the following bill; 
which was referred to the Committee on Homeland Security 
APRIL 17, 2015 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on April 13, 2015] 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
A BILL 
To amend the Homeland Security Act of 2002 to enhance 
multi-directional sharing of information related to cyber-
security risks and strengthen privacy and civil liberties 
protections, and for other purposes. 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘National Cybersecurity 
Protection Advancement Act of 2015’’. 
SEC. 2. NATIONAL CYBERSECURITY AND COMMUNICATIONS 
INTEGRATION CENTER. 
(a) DEFINITIONS.— 
(1) IN GENERAL.—Subsection (a) of the second 
section 226 of the Homeland Security Act of 2002 (6 
U.S.C. 148; relating to the National Cybersecurity 
and Communications Integration Center) is amend-
ed— 
(A) in paragraph (3), by striking ‘‘and’’ at 
the end; 
(B) in paragraph (4), by striking the period 
at the end and inserting ‘‘; and’’; and 
(C) by adding at the end the following new 
paragraphs: 
‘‘(5) the term ‘cyber threat indicator’ means 
technical information that is necessary to describe or 
identify— 
‘‘(A) a method for probing, monitoring, 
maintaining, or establishing network awareness 
of an information system for the purpose of dis-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
cerning technical vulnerabilities of such informa-
tion system, if such method is known or reason-
ably suspected of being associated with a known 
or suspected cybersecurity risk, including com-
munications that reasonably appear to be trans-
mitted for the purpose of gathering technical in-
formation related to a cybersecurity risk; 
‘‘(B) a method for defeating a technical or 
security control of an information system; 
‘‘(C) a technical vulnerability, including 
anomalous technical behavior that may become a 
vulnerability; 
‘‘(D) a method of causing a user with legiti-
mate access to an information system or infor-
mation that is stored on, processed by, or 
transiting an information system to inadvert-
ently enable the defeat of a technical or oper-
ational control; 
‘‘(E) a method for unauthorized remote 
identification of, access to, or use of an informa-
tion system or information that is stored on, 
processed by, or transiting an information sys-
tem that is known or reasonably suspected of 
being associated with a known or suspected cy-
bersecurity risk; 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(F) the actual or potential harm caused by 
a cybersecurity risk, including a description of 
the information exfiltrated as a result of a par-
ticular cybersecurity risk; 
‘‘(G) any other attribute of a cybersecurity 
risk that cannot be used to identify specific per-
sons reasonably believed to be unrelated to such 
cybersecurity risk, if disclosure of such attribute 
is not otherwise prohibited by law; or 
‘‘(H) any combination of subparagraphs 
(A) through (G); 
‘‘(6) the term ‘cybersecurity purpose’ means the 
purpose of protecting an information system or infor-
mation that is stored on, processed by, or transiting 
an information system from a cybersecurity risk or 
incident; 
‘‘(7)(A) except as provided in subparagraph (B), 
the term ‘defensive measure’ means an action, device, 
procedure, signature, technique, or other measure ap-
plied to an information system or information that is 
stored on, processed by, or transiting an information 
system that detects, prevents, or mitigates a known or 
suspected cybersecurity risk or incident, or any at-
tribute of hardware, software, process, or procedure 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
that could enable or facilitate the defeat of a security 
control; 
‘‘(B) such term does not include a measure that 
destroys, renders unusable, or substantially harms an 
information system or data on an information system 
not belonging to— 
‘‘(i) the non-Federal entity, not including a 
State, local, or tribal government, operating such 
measure; or 
‘‘(ii) another Federal entity or non-Federal 
entity that is authorized to provide consent and 
has provided such consent to the non-Federal en-
tity referred to in clause (i); 
‘‘(8) the term ‘network awareness’ means to scan, 
identify, acquire, monitor, log, or analyze informa-
tion that is stored on, processed by, or transiting an 
information system; 
‘‘(9)(A) the term ‘private entity’ means a non- 
Federal entity that is an individual or private group, 
organization, proprietorship, partnership, trust, coop-
erative, corporation, or other commercial or non-prof-
it entity, including an officer, employee, or agent 
thereof; 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(B) such term includes a component of a State, 
local, or tribal government performing electric utility 
services; 
‘‘(10) the term ‘security control’ means the man-
agement, operational, and technical controls used to 
protect against an unauthorized effort to adversely af-
fect the confidentially, integrity, or availability of an 
information system or information that is stored on, 
processed by, or transiting an information system; 
and 
‘‘(11) the term ‘sharing’ means providing, receiv-
ing, and disseminating.’’. 
(b) AMENDMENT.—Subparagraph (B) of subsection 
(d)(1) of such second section 226 of the Homeland Security 
Act of 2002 is amended— 
(1) in clause (i), by striking ‘‘and local’’ and in-
serting ‘‘, local, and tribal’’; 
(2) in clause (ii)— 
(A) by inserting ‘‘, including information 
sharing and analysis centers’’ before the semi-
colon; and 
(B) by striking ‘‘and’’ at the end; 
(3) in clause (iii), by striking the period at the 
end and inserting ‘‘; and’’; and 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
(4) by adding at the end the following new 
clause: 
‘‘(iv) private entities.’’. 
SEC. 3. INFORMATION SHARING STRUCTURE AND PROC-
ESSES. 
The second section 226 of the Homeland Security Act 
of 2002 (6 U.S.C. 148; relating to the National Cybersecu-
rity and Communications Integration Center) is amend-
ed— 
(1) in subsection (c)— 
(A) in paragraph (1)— 
(i) by striking ‘‘a Federal civilian 
interface’’ and inserting ‘‘the lead Federal 
civilian interface’’; and 
(ii) by striking ‘‘cybersecurity risks,’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; 
(B) in paragraph (3), by striking ‘‘cyberse-
curity risks’’ and inserting ‘‘cyber threat indica-
tors, defensive measures, cybersecurity risks,’’; 
(C) in paragraph (5)(A), by striking ‘‘cy-
bersecurity risks’’ and inserting ‘‘cyber threat in-
dicators, 
defensive 
measures, 
cybersecurity 
risks,’’; 
(D) in paragraph (6)— 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
(i) by striking ‘‘cybersecurity risks’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; and 
(ii) by striking ‘‘and’’ at the end; 
(E) in paragraph (7)— 
(i) in subparagraph (A), by striking 
‘‘and’’ at the end; 
(ii) in subparagraph (B), by striking 
the period at the end and inserting ‘‘; and’’; 
and 
(iii) by adding at the end the following 
new subparagraph: 
‘‘(C) sharing cyber threat indicators and de-
fensive measures;’’; and 
(F) by adding at the end the following new 
paragraphs 
‘‘(8) engaging with international partners, in 
consultation with other appropriate agencies, to— 
‘‘(A) collaborate on cyber threat indicators, 
defensive measures, and information related to 
cybersecurity risks and incidents; and 
‘‘(B) enhance the security and resilience of 
global cybersecurity; 
‘‘(9) sharing cyber threat indicators, defensive 
measures, and other information related to cybersecu-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
rity risks and incidents with Federal and non-Fed-
eral entities, including across sectors of critical infra-
structure and with State and major urban area fu-
sion centers, as appropriate; 
‘‘(10) promptly notifying the Secretary and the 
Committee on Homeland Security of the House of 
Representatives and the Committee on Homeland Se-
curity and Governmental Affairs of the Senate of any 
significant violations of the policies and procedures 
specified in subsection (i)(6)(A); 
‘‘(11) promptly notifying non-Federal entities 
that have shared cyber threat indicators or defensive 
measures that are known or determined to be in error 
or in contravention of the requirements of this section; 
and 
‘‘(12) participating, as appropriate, in exercises 
run by the Department’s National Exercise Pro-
gram.’’; 
(2) in subsection (d)— 
(A) in subparagraph (D), by striking ‘‘and’’ 
at the end; 
(B) by redesignating subparagraph (E) as 
subparagraph (J); and 
(C) by inserting after subparagraph (D) the 
following new subparagraphs: 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(E) an entity that collaborates with State 
and local governments on cybersecurity risks and 
incidents, and has entered into a voluntary in-
formation sharing relationship with the Center; 
‘‘(F) a United States Computer Emergency 
Readiness Team that coordinates information re-
lated to cybersecurity risks and incidents, 
proactively and collaboratively addresses cyberse-
curity risks and incidents to the United States, 
collaboratively responds to cybersecurity risks 
and incidents, provides technical assistance, 
upon request, to information system owners and 
operators, and shares cyber threat indicators, de-
fensive measures, analysis, or information re-
lated to cybersecurity risks and incidents in a 
timely manner; 
‘‘(G) the Industrial Control System Cyber 
Emergency Response Team that— 
‘‘(i) coordinates with industrial control 
systems owners and operators; 
‘‘(ii) provides training, upon request, 
to Federal entities and non-Federal entities 
on industrial control systems cybersecurity; 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
by working with the Chief Privacy Officer ap-
pointed under section 222 to ensure that the Cen-
ter follows the policies and procedures specified 
in subsection (i)(6)(A)’’; and 
(4) by adding at the end the following new sub-
sections: 
‘‘(g) RAPID AUTOMATED SHARING.— 
‘‘(1) IN GENERAL.—The Under Secretary for Cy-
bersecurity and Infrastructure Protection, in coordi-
nation with industry and other stakeholders, shall de-
velop capabilities making use of existing information 
technology industry standards and best practices, as 
appropriate, that support and rapidly advance the 
development, adoption, and implementation of auto-
mated mechanisms for the timely sharing of cyber 
threat indicators and defensive measures to and from 
the Center and with each Federal agency designated 
as the ‘Sector Specific Agency’ for each critical infra-
structure sector in accordance with subsection (h). 
‘‘(2) BIANNUAL REPORT.—The Under Secretary 
for Cybersecurity and Infrastructure Protection shall 
submit to the Committee on Homeland Security of the 
House of Representatives and the Committee on 
Homeland Security and Governmental Affairs of the 
Senate a biannual report on the status and progress 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
of the development of the capability described in 
paragraph (1). Such reports shall be required until 
such capability is fully implemented. 
‘‘(h) SECTOR SPECIFIC AGENCIES.—The Secretary, in 
collaboration with the relevant critical infrastructure sector 
and the heads of other appropriate Federal agencies, shall 
recognize the Federal agency designated as of March 25, 
2015, as the ‘Sector Specific Agency’ for each critical infra-
structure sector designated in the Department’s National 
Infrastructure Protection Plan. If the designated Sector 
Specific Agency for a particular critical infrastructure sec-
tor is the Department, for purposes of this section, the Sec-
retary is deemed to be the head of such Sector Specific Agen-
cy and shall carry out this section. The Secretary, in co-
ordination with the heads of each such Sector Specific Agen-
cy, shall— 
‘‘(1) support the security and resilience actives of 
the relevant critical infrastructure sector in accord-
ance with this section; 
‘‘(2) provide institutional knowledge, specialized 
expertise, and technical assistance upon request to the 
relevant critical infrastructure sector; and 
‘‘(3) support the timely sharing of cyber threat 
indicators and defensive measures with the relevant 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
critical infrastructure sector with the Center in ac-
cordance with this section. 
‘‘(i) VOLUNTARY
INFORMATION
SHARING
PROCE-
DURES.— 
‘‘(1) PROCEDURES.— 
‘‘(A) IN GENERAL.—The Center may enter 
into a voluntary information sharing relation-
ship with any consenting non-Federal entity for 
the sharing of cyber threat indicators and defen-
sive measures for cybersecurity purposes in ac-
cordance with this section. Nothing in this sec-
tion may be construed to require any non-Fed-
eral entity to enter into any such information 
sharing relationship with the Center or any 
other entity. The Center may terminate a vol-
untary information sharing relationship under 
this subsection if the Center determines that the 
non-Federal entity with which the Center has en-
tered into such a relationship has, after repeated 
notice, repeatedly violated the terms of this sub-
section. 
‘‘(B) NATIONAL SECURITY.—The Secretary 
may decline to enter into a voluntary informa-
tion sharing relationship under this subsection if 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
the Secretary determines that such is appro-
priate for national security. 
‘‘(2) VOLUNTARY INFORMATION SHARING RELA-
TIONSHIPS.—A voluntary information sharing rela-
tionship under this subsection may be characterized 
as an agreement described in this paragraph. 
‘‘(A) STANDARD AGREEMENT.—For the use 
of a non-Federal entity, the Center shall make 
available a standard agreement, consistent with 
this section, on the Department’s website. 
‘‘(B) NEGOTIATED AGREEMENT.—At the re-
quest of a non-Federal entity, and if determined 
appropriate by the Center, the Department shall 
negotiate a non-standard agreement, consistent 
with this section. 
‘‘(C) EXISTING
AGREEMENTS.—An agree-
ment between the Center and a non-Federal enti-
ty that is entered into before the date of the en-
actment of this section, or such an agreement 
that is in effect before such date, shall be deemed 
in compliance with the requirements of this sub-
section, notwithstanding any other provision or 
requirement of this subsection. An agreement 
under this subsection shall include the relevant 
privacy protections as in effect under the Cooper-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
ative Research and Development Agreement for 
Cybersecurity Information Sharing and Collabo-
ration, as of December 31, 2014. Nothing in this 
subsection may be construed to require a non- 
Federal entity to enter into either a standard or 
negotiated agreement to be in compliance with 
this subsection. 
‘‘(3) INFORMATION SHARING AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B), and notwithstanding any 
other provision of law, a non-Federal entity 
may, for cybersecurity purposes, share cyber 
threat indicators or defensive measures obtained 
on its own information system, or on an infor-
mation system of another Federal entity or non- 
Federal entity, upon written consent of such 
other Federal entity or non-Federal entity or an 
authorized representative of such other Federal 
entity or non-Federal entity in accordance with 
this section with— 
‘‘(i) another non-Federal entity; or 
‘‘(ii) the Center, as provided in this 
section. 
‘‘(B) LAWFUL
RESTRICTION.—A non-Fed-
eral entity receiving a cyber threat indicator or 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
defensive measure from another Federal entity or 
non-Federal entity shall comply with otherwise 
lawful restrictions placed on the sharing or use 
of such cyber threat indicator or defensive meas-
ure by the sharing Federal entity or non-Federal 
entity. 
‘‘(C) REMOVAL
OF
INFORMATION
UNRE-
LATED
TO
CYBERSECURITY
RISKS
OR
INCI-
DENTS.—Federal entities and non-Federal enti-
ties shall, prior to such sharing, take reasonable 
efforts to remove information that can be used to 
identify specific persons and is reasonably be-
lieved at the time of sharing to be unrelated to 
a cybersecurity risks or incident and to safe-
guard information that can be used to identify 
specific persons from unintended disclosure or 
unauthorized access or acquisition. 
‘‘(D) RULE OF CONSTRUCTION.—Nothing in 
this paragraph may be construed to— 
‘‘(i) limit or modify an existing infor-
mation sharing relationship; 
‘‘(ii) prohibit a new information shar-
ing relationship; 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS