SEC. 2. CONGRESSIONAL FINDINGS. 
Congress finds the following: 
(1) Cyber fraud and related cyber-enabled 
crimes pose a severe threat to the national security 
and economic vitality of the United States. 
(2) As a result of the unique nature of 
cybercrime, it is very difficult for law enforcement to 
respond to and prosecute cybercrime in a timely 
manner, leading to the existing low level of deter-
rence and a rapidly growing threat. In 2017, the De-
partment of Justice prosecuted only 165 cases of 
computer fraud. Congress determines that this sta-
tus quo is unacceptable and that if left unchecked, 
the trend in cybercrime will only continue to deterio-
rate. 
(3) Cybercriminals have developed new tactics 
for monetizing the proceeds of their criminal acts, 
making it likely that the criminal activity will be fur-
ther incentivized in the absence of reforms to cur-
rent law allowing for new cyber tools and deterrence 
methods for defenders. 
(4) When a citizen or United States business is 
victimized as the result of such crime, the first re-
course should be to report the crime to law enforce-
ment and seek to improve defensive measures. 
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
(5) Congress also acknowledges that many 
cyberattacks could be prevented through improved 
cyber defensive practices, including enhanced train-
ing, strong passwords, and routine updating and 
patching to computer systems. 
(6) Congress determines that the use of active 
cyber defense techniques, when properly applied, can 
also assist in improving defenses and deterring 
cybercrimes. 
(7) Congress also acknowledges that many pri-
vate entities are increasingly concerned with stem-
ming the growth of dark web based cyber-enabled 
crimes. The Department of Justice should attempt 
to clarify the proper protocol for entities who are en-
gaged in active cyber defense in the dark web so 
that these defenders can return private property 
such as intellectual property and financial records 
gathered inadvertently. 
(8) Congress also recognizes that while Federal 
agencies will need to prioritize cyber incidents of na-
tional significance, there is the potential to assist the 
private sector by being more responsive to reports of 
crime through different reporting mechanisms. Many 
reported cybercrimes are not responded to in a time-
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
ly manner creating significant uncertainty for many 
businesses and individuals. 
(9) Computer defenders should also exercise ex-
treme caution to avoid violating the law of any other 
nation where an attacker’s computer may reside. 
(10) Congress holds that active cyber defense 
techniques should only be used by qualified defend-
ers with a high degree of confidence in attribution, 
and that extreme caution should be taken to avoid 
impacting intermediary computers or resulting in an 
escalatory cycle of cyber activity. 
(11) It is the purpose of this Act to provide 
legal certainty by clarifying the type of tools and 
techniques that defenders can use that exceed the 
boundaries of their own computer network. 
SEC. 3. EXCEPTION FOR THE USE OF ATTRIBUTIONAL 
TECHNOLOGY. 
Section 1030 of title 18, United States Code, is 
amended by adding at the end the following: 
‘‘(k) EXCEPTION FOR THE USE OF ATTRIBUTIONAL 
TECHNOLOGY.— 
‘‘(1) This section shall not apply with respect to 
the use of attributional technology in regard to a de-
fender who uses a program, code, or command for 
attributional purposes that beacons or returns loca-
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
tional or attributional data in response to a cyber in-
trusion in order to identify the source of an intru-
sion; if— 
‘‘(A) the program, code, or command origi-
nated on the computer of the defender but is 
copied or removed by an unauthorized user; and 
‘‘(B) the program, code, or command does 
not result in the destruction of data or result 
in an impairment of the essential operating 
functionality of the attacker’s computer system, 
or intentionally create a backdoor enabling in-
trusive access into the attacker’s computer sys-
tem. 
‘‘(2) DEFINITION.—The term ‘attributional 
data’ means any digital information such as log files, 
text strings, time stamps, malware samples, identi-
fiers such as user names and Internet Protocol ad-
dresses and metadata or other digital artifacts gath-
ered through forensic analysis.’’. 
SEC. 4. EXCLUSION FROM PROSECUTION FOR CERTAIN 
COMPUTER CRIMES FOR THOSE TAKING AC-
TIVE CYBER DEFENSE MEASURES. 
Section 1030 of title 18, United States Code, is 
amended by adding at the end the following: 
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS
‘‘(l) ACTIVE CYBER DEFENSE MEASURES NOT A 
VIOLATION.— 
‘‘(1) GENERALLY.—It is a defense to a criminal 
prosecution under this section that the conduct con-
stituting the offense was an active cyber defense 
measure. 
‘‘(2) INAPPLICABILITY TO CIVIL ACTION.—The 
defense against prosecution created by this section 
does not prevent a United States person or entity 
who is targeted by an active defense measure from 
seeking a civil remedy, including compensatory dam-
ages or injunctive relief pursuant to subsection (g). 
‘‘(3) DEFINITIONS.—In this subsection— 
‘‘(A) the term ‘defender’ means a person 
or an entity that is a victim of a persistent un-
authorized intrusion of the individual entity’s 
computer; 
‘‘(B) the term ‘active cyber defense meas-
ure’— 
‘‘(i) means any measure— 
‘‘(I) undertaken by, or at the di-
rection of, a defender; and 
‘‘(II) 
consisting 
of 
accessing 
without authorization the computer of 
the attacker to the defender’s own 
VerDate Sep 11 2014 
04:22 Jun 18, 2019
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3270.IH
H3270
kjohnson on DSK79L0C42 with BILLS