‘‘(iii) require a new information shar-
ing relationship between any non-Federal 
entity and a Federal entity; 
‘‘(iv) limit otherwise lawful activity; or 
‘‘(v) in any manner impact or modify 
procedures in existence as of the date of the 
enactment of this section for reporting 
known or suspected criminal activity to ap-
propriate law enforcement authorities or for 
participating voluntarily or under legal re-
quirement in an investigation. 
‘‘(E) COORDINATED
VULNERABILITY
DIS-
CLOSURE.—The Under Secretary for Cybersecu-
rity and Infrastructure Protection, in coordina-
tion with industry and other stakeholders, shall 
develop, publish, and adhere to policies and pro-
cedures for coordinating vulnerability disclo-
sures, to the extent practicable, consistent with 
international standards in the information tech-
nology industry. 
‘‘(4) NETWORK AWARENESS AUTHORIZATION.— 
‘‘(A) IN
GENERAL.—Notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government, 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
may, for cybersecurity purposes, conduct network 
awareness of— 
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity, upon written consent of 
such other non-Federal entity for con-
ducting such network awareness to protect 
the rights or property of such other non- 
Federal entity; 
‘‘(iii) an information system of a Fed-
eral entity, upon written consent of an au-
thorized representative of such Federal enti-
ty for conducting such network awareness to 
protect the rights or property of such Fed-
eral entity; or 
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing in 
this paragraph may be construed to— 
‘‘(i) 
authorize 
conducting 
network 
awareness of an information system, or the 
use of any information obtained through 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
such conducting of network awareness, other 
than as provided in this section; or 
‘‘(ii) limit otherwise lawful activity. 
‘‘(5) DEFENSIVE MEASURE AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B) and notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government, 
may, for cybersecurity purposes, operate a defen-
sive measure that is applied to— 
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity upon written consent of 
such other non-Federal entity for operation 
of such defensive measure to protect the 
rights or property of such other non-Federal 
entity; 
‘‘(iii) an information system of a Fed-
eral entity upon written consent of an au-
thorized representative of such Federal enti-
ty for operation of such defensive measure 
to protect the rights or property of such 
Federal entity; or 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing in 
this paragraph may be construed to— 
‘‘(i) authorize the use of a defensive 
measure other than as provided in this sec-
tion; or 
‘‘(ii) limit otherwise lawful activity. 
‘‘(6) PRIVACY
AND
CIVIL
LIBERTIES
PROTEC-
TIONS.— 
‘‘(A) POLICIES AND PROCEDURES.— 
‘‘(i) IN
GENERAL.—The Under Sec-
retary for Cybersecurity and Infrastructure 
Protection shall, in coordination with the 
Chief Privacy Officer and the Chief Civil 
Rights and Civil Liberties Officer of the De-
partment, establish and annually review 
policies and procedures governing the re-
ceipt, retention, use, and disclosure of cyber 
threat indicators, defensive measures, and 
information related to cybersecurity risks 
and incidents shared with the Center in ac-
cordance with this section. Such policies 
and procedures shall apply only to the De-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
partment, consistent with the need to pro-
tect information systems from cybersecurity 
risks and incidents and mitigate cybersecu-
rity risks and incidents in a timely man-
ner, and shall— 
‘‘(I) be consistent with the De-
partment’s Fair Information Practice 
Principles developed pursuant to sec-
tion 552a of title 5, United States Code 
(commonly referred to as the ‘Privacy 
Act of 1974’ or the ‘Privacy Act’), and 
subject to the Secretary’s authority 
under subsection (a)(2) of section 222 
of this Act; 
‘‘(II) reasonably limit, to the 
greatest extent practicable, the receipt, 
retention, use, and disclosure of cyber 
threat indicators and defensive meas-
ures associated with specific persons 
that is not necessary, for cybersecurity 
purposes, to protect a network or infor-
mation system from cybersecurity risks 
or mitigate cybersecurity risks and in-
cidents in a timely manner; 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(III) minimize any impact on 
privacy and civil liberties; 
‘‘(IV) 
provide 
data 
integrity 
through the prompt removal and de-
struction of obsolete or erroneous 
names and personal information that 
is unrelated to the cybersecurity risk or 
incident information shared and re-
tained by the Center in accordance 
with this section; 
‘‘(V) include requirements to safe-
guard cyber threat indicators and de-
fensive measures retained by the Cen-
ter, including information that is pro-
prietary or business-sensitive that may 
be used to identify specific persons 
from unauthorized access or acquisi-
tion; 
‘‘(VI) protect the confidentiality of 
cyber threat indicators and defensive 
measures associated with specific per-
sons to the greatest extent practicable; 
and 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(VII) ensure all relevant con-
stitutional, legal, and privacy protec-
tions are observed. 
‘‘(ii) SUBMISSION TO CONGRESS.—Not 
later than 180 days after the date of the en-
actment of this section and annually there-
after, the Chief Privacy Officer and the Of-
ficer for Civil Rights and Civil Liberties of 
the Department, in consultation with the 
Privacy and Civil Liberties Oversight 
Board (established pursuant to section 1061 
of the Intelligence Reform and Terrorism 
Prevention Act of 2004 (42 U.S.C. 2000ee)), 
shall submit to the Committee on Homeland 
Security of the House of Representatives 
and the Committee on Homeland Security 
and Governmental Affairs of the Senate the 
policies and procedures governing the shar-
ing of cyber threat indicators, defensive 
measures, 
and 
information 
related 
to 
cybsersecurity risks and incidents described 
in clause (i) of subparagraph (A). 
‘‘(iii) PUBLIC NOTICE AND ACCESS.— 
The Under Secretary for Cybersecurity and 
Infrastructure Protection, in consultation 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
with the Chief Privacy Officer and the Chief 
Civil Rights and Civil Liberties Officer of 
the Department, and the Privacy and Civil 
Liberties Oversight Board (established pur-
suant to section 1061 of the Intelligence Re-
form and Terrorism Prevention Act of 2004 
(42 U.S.C. 2000ee)), shall ensure there is 
public notice of, and access to, the policies 
and procedures governing the sharing of 
cyber threat indicators, defensive measures, 
and information related to cybersecurity 
risks and incidents. 
‘‘(iv) CONSULTATION.—The Under Sec-
retary for Cybersecurity and Infrastructure 
Protection when establishing policies and 
procedures to support privacy and civil lib-
erties may consult with the National Insti-
tute of Standards and Technology. 
‘‘(B) IMPLEMENTATION.—The Chief Privacy 
Officer of the Department, on an ongoing basis, 
shall— 
‘‘(i) monitor the implementation of the 
policies and procedures governing the shar-
ing of cyber threat indicators and defensive 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
measures established pursuant to clause (i) 
of subparagraph (A); 
‘‘(ii) regularly review and update pri-
vacy impact assessments, as appropriate, to 
ensure all relevant constitutional, legal, and 
privacy protections are being followed; 
‘‘(iii) work with the Under Secretary 
for Cybersecurity and Infrastructure Protec-
tion to carry out paragraphs (10) and (11) 
of subsection (c); 
‘‘(iv) annually submit to the Com-
mittee on Homeland Security of the House 
of Representatives and the Committee on 
Homeland Security and Governmental Af-
fairs of the Senate a report that contains a 
review of the effectiveness of such policies 
and procedures to protect privacy and civil 
liberties; and 
‘‘(v) ensure there are appropriate sanc-
tions in place for officers, employees, or 
agents of the Department who intentionally 
or willfully conduct activities under this 
section in an unauthorized manner. 
‘‘(C) INSPECTOR
GENERAL
REPORT.—The 
Inspector General of the Department, in con-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
sultation with the Privacy and Civil Liberties 
Oversight Board and the Inspector General of 
each Federal agency that receives cyber threat 
indicators or defensive measures shared with the 
Center under this section, shall, not later than 
two years after the date of the enactment of this 
subsection and periodically thereafter submit to 
the Committee on Homeland Security of the 
House of Representatives and the Committee on 
Homeland Security and Governmental Affairs of 
the Senate a report containing a review of the 
use of cybersecurity risk information shared with 
the Center, including the following: 
‘‘(i) A report on the receipt, use, and 
dissemination of cyber threat indicators and 
defensive measures that have been shared 
with Federal entities under this section. 
‘‘(ii) Information on the use by the 
Center of such information for a purpose 
other than a cybersecurity purpose. 
‘‘(iii) A review of the type of informa-
tion shared with the Center under this sec-
tion. 
‘‘(iv) A review of the actions taken by 
the Center based on such information. 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(v) The appropriate metrics that exist 
to determine the impact, if any, on privacy 
and civil liberties as a result of the sharing 
of such information with the Center. 
‘‘(vi) A list of other Federal agencies 
receiving such information. 
‘‘(vii) A review of the sharing of such 
information within the Federal Government 
to identify inappropriate stove piping of 
such information. 
‘‘(viii) Any recommendations of the In-
spector General of the Department for im-
provements or modifications to information 
sharing under this section. 
‘‘(D) PRIVACY AND CIVIL LIBERTIES OFFI-
CERS REPORT.—The Chief Privacy Officer and 
the Chief Civil Rights and Civil Liberties Officer 
of the Department, in consultation with the Pri-
vacy and Civil Liberties Oversight Board, the 
Inspector General of the Department, and the 
senior privacy and civil liberties officer of each 
Federal agency that receives cyber threat indica-
tors and defensive measures shared with the Cen-
ter under this section, shall biennially submit to 
the appropriate congressional committees a re-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
port assessing the privacy and civil liberties im-
pact of the activities under this paragraph. Each 
such report shall include any recommendations 
the Chief Privacy Officer and the Chief Civil 
Rights and Civil Liberties Officer of the Depart-
ment consider appropriate to minimize or miti-
gate the privacy and civil liberties impact of the 
sharing of cyber threat indicators and defensive 
measures under this section. 
‘‘(E) FORM.—Each report required under 
paragraphs (C) and (D) shall be submitted in 
unclassified form, but may include a classified 
annex. 
‘‘(7) USES AND PROTECTION OF INFORMATION.— 
‘‘(A) NON-FEDERAL ENTITIES.—A non-Fed-
eral entity, not including a State, local, or tribal 
government, that shares cyber threat indicators 
or defensive measures through the Center or oth-
erwise under this section— 
‘‘(i) may use, retain, or further disclose 
such cyber threat indicators or defensive 
measures solely for cybersecurity purposes; 
‘‘(ii) shall, prior to such sharing, take 
reasonable efforts to remove information 
that can be used to identify specific persons 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
and is reasonably believed at the time of 
sharing to be unrelated to a cybersecurity 
risk or incident, and to safeguard informa-
tion that can be used to identify specific 
persons from unintended disclosure or un-
authorized access or acquisition; 
‘‘(iii) shall comply with appropriate 
restrictions that a Federal entity or non- 
Federal entity places on the subsequent dis-
closure or retention of cyber threat indica-
tors and defensive measures that it discloses 
to other Federal entities or non-Federal en-
tities; 
‘‘(iv) shall be deemed to have volun-
tarily shared such cyber threat indicators or 
defensive measures; 
‘‘(v) shall implement and utilize a se-
curity control to protect against unauthor-
ized access to or acquisition of such cyber 
threat indicators or defensive measures; and 
‘‘(vi) may not use such information to 
gain an unfair competitive advantage to the 
detriment of any non-Federal entity. 
‘‘(B) FEDERAL ENTITIES.— 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(i) USES OF INFORMATION.—A Fed-
eral entity that receives cyber threat indica-
tors or defensive measures shared through 
the Center or otherwise under this section 
from another Federal entity or a non-Fed-
eral entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators or 
defensive measures solely for cybersecu-
rity purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove infor-
mation that can be used to identify 
specific persons and is reasonably be-
lieved at the time of sharing to be un-
related to a cybersecurity risk or inci-
dent, and to safeguard information 
that can be used to identify specific 
persons from unintended disclosure or 
unauthorized access or acquisition; 
‘‘(III) shall be deemed to have vol-
untarily shared such cyber threat indi-
cators or defensive measures; 
‘‘(IV) shall implement and utilize 
a security control to protect against 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
unauthorized access to or acquisition of 
such cyber threat indicators or defen-
sive measures; and 
‘‘(V) may not use such cyber 
threat indicators or defensive measures 
to engage in surveillance or other col-
lection activities for the purpose of 
tracking an individual’s personally 
identifiable information. 
‘‘(ii) 
PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
‘‘(I) are exempt from disclosure 
under section 552 of title 5, United 
States Code, and withheld, without dis-
cretion, from the public under sub-
section (b)(3)(B) of such section; 
‘‘(II) may not be used by the Fed-
eral Government for regulatory pur-
poses; 
‘‘(III) may not constitute a waiv-
er of any applicable privilege or pro-
tection provided by law, including 
trade secret protection; 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(IV) shall be considered the com-
mercial, financial, and proprietary in-
formation of the non-Federal entity re-
ferred to in clause (i) when so des-
ignated by such non-Federal entity; 
and 
‘‘(V) may not be subject to a rule 
of any Federal entity or any judicial 
doctrine regarding ex parte commu-
nications with a decisionmaking offi-
cial. 
‘‘(C) STATE, LOCAL, OR TRIBAL GOVERN-
MENT.— 
‘‘(i) USES OF INFORMATION.—A State, 
local, or tribal government that receives 
cyber threat indicators or defensive meas-
ures from the Center from a Federal entity 
or a non-Federal entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators or 
defensive measures solely for cybersecu-
rity purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove infor-
mation that can be used to identify 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
specific persons and is reasonably be-
lieved at the time of sharing to be un-
related to a cybersecurity risk or inci-
dent, and to safeguard information 
that can be used to identify specific 
persons from unintended disclosure or 
unauthorized access or acquisition; 
‘‘(III) shall consider such infor-
mation the commercial, financial, and 
proprietary information of such Fed-
eral entity or non-Federal entity if so 
designated by such Federal entity or 
non-Federal entity; 
‘‘(IV) shall be deemed to have vol-
untarily shared such cyber threat indi-
cators or defensive measures; and 
‘‘(V) shall implement and utilize 
a security control to protect against 
unauthorized access to or acquisition of 
such cyber threat indicators or defen-
sive measures. 
‘‘(ii) 
PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(I) shall be exempt from disclo-
sure under any State, local, or tribal 
law or regulation that requires public 
disclosure of information or records by 
a public or quasi-public entity; and 
‘‘(II) may not be used by any 
State, local, or tribal government to 
regulate a lawful activity of a non- 
Federal entity. 
‘‘(8) LIABILITY EXEMPTIONS.— 
‘‘(A) NETWORK AWARENESS.—No cause of 
action shall lie or be maintained in any court, 
and such action shall be promptly dismissed, 
against any non-Federal entity that, for cyberse-
curity purposes, conducts network awareness 
under paragraph (4), if such network awareness 
is conducted in accordance with such paragraph 
and this section. 
‘‘(B) INFORMATION SHARING.—No cause of 
action shall lie or be maintained in any court, 
and such action shall be promptly dismissed, 
against any non-Federal entity that, for cyberse-
curity purposes, shares cyber threat indicators or 
defensive measures under paragraph (3), or fails 
to act based on such sharing, if such sharing is 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(i) amend, repeal, or supersede any 
current or future contractual agreement, 
terms of service agreement, or other contrac-
tual relationship between any non-Federal 
entities, or between any non-Federal entity 
and a Federal entity; or 
‘‘(ii) abrogate trade secret or intellec-
tual property rights of any non-Federal en-
tity or Federal entity. 
‘‘(E) ANTI-TASKING RESTRICTION.—Nothing 
in this section may be construed to permit a 
Federal entity to— 
‘‘(i) require a non-Federal entity to 
provide information to a Federal entity; 
‘‘(ii) condition the sharing of cyber 
threat indicators or defensive measures with 
a non-Federal entity on such non-Federal 
entity’s provision of cyber threat indicators 
or defensive measures to a Federal entity; or 
‘‘(iii) condition the award of any Fed-
eral grant, contract, or purchase on the 
sharing of cyber threat indicators or defen-
sive measures with a Federal entity. 
‘‘(F) NO
LIABILITY
FOR
NON-PARTICIPA-
TION.—Nothing in this section may be construed 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS