1709 
erning disclosures to Congress), section 1034 of title 10, 
United States Code (governing disclosure to Congress by 
members of the military), section 1104 of the National Secu-
rity Act of 1947 (50 U.S.C. 3234) (governing disclosure by 
employees of elements of the intelligence community), or 
any similar provision of Federal or State law. 
(c) PROTECTION OF SOURCES AND METHODS.—Noth-
ing in this title shall be construed— 
(1) as creating any immunity against, or other-
wise affecting, any action brought by the Federal 
Government, or any agency or department thereof, to 
enforce any law, executive order, or procedure gov-
erning the appropriate handling, disclosure, or use of 
classified information; 
(2) to affect the conduct of authorized law en-
forcement or intelligence activities; or 
(3) to modify the authority of a department or 
agency of the Federal Government to protect classified 
information and sources and methods and the na-
tional security of the United States. 
(d) RELATIONSHIP TO OTHER LAWS.—Nothing in this 
title shall be construed to affect any requirement under any 
other provision of law for a non-Federal entity to provide 
information to the Federal Government.
1710 
(e) PROHIBITED CONDUCT.—Nothing in this title shall 
be construed to permit price-fixing, allocating a market be-
tween competitors, monopolizing or attempting to monopo-
lize a market, boycotting, or exchanges of price or cost infor-
mation, customer lists, or information regarding future 
competitive planning. 
(f) INFORMATION SHARING RELATIONSHIPS.—Nothing 
in this title shall be construed— 
(1) to limit or modify an existing information 
sharing relationship; 
(2) to prohibit a new information sharing rela-
tionship; 
(3) to require a new information sharing rela-
tionship between any non-Federal entity and a Fed-
eral entity or another non-Federal entity; or 
(4) to require the use of the capability and proc-
ess within the Department of Homeland Security de-
veloped under section 105(c). 
(g) PRESERVATION
OF CONTRACTUAL OBLIGATIONS 
AND RIGHTS.—Nothing in this title shall be construed— 
(1) to amend, repeal, or supersede any current or 
future contractual agreement, terms of service agree-
ment, or other contractual relationship between any 
non-Federal entities, or between any non-Federal en-
tity and a Federal entity; or
1711 
(2) to abrogate trade secret or intellectual prop-
erty rights of any non-Federal entity or Federal enti-
ty. 
(h) ANTI-TASKING RESTRICTION.—Nothing in this 
title shall be construed to permit a Federal entity— 
(1) to require a non-Federal entity to provide in-
formation to a Federal entity or another non-Federal 
entity; 
(2) to condition the sharing of cyber threat indi-
cators with a non-Federal entity on such entity’s pro-
vision of cyber threat indicators to a Federal entity 
or another non-Federal entity; or 
(3) to condition the award of any Federal grant, 
contract, or purchase on the provision of a cyber 
threat indicator to a Federal entity or another non- 
Federal entity. 
(i) NO LIABILITY FOR NON-PARTICIPATION.—Nothing 
in this title shall be construed to subject any entity to liabil-
ity for choosing not to engage in the voluntary activities 
authorized in this title. 
(j) USE AND RETENTION OF INFORMATION.—Nothing 
in this title shall be construed to authorize, or to modify 
any existing authority of, a department or agency of the 
Federal Government to retain or use any information
1712 
shared under this title for any use other than permitted 
in this title. 
(k) FEDERAL PREEMPTION.— 
(1) IN GENERAL.—This title supersedes any stat-
ute or other provision of law of a State or political 
subdivision of a State that restricts or otherwise ex-
pressly regulates an activity authorized under this 
title. 
(2) STATE LAW ENFORCEMENT.—Nothing in this 
title shall be construed to supersede any statute or 
other provision of law of a State or political subdivi-
sion of a State concerning the use of authorized law 
enforcement practices and procedures. 
(l) REGULATORY AUTHORITY.—Nothing in this title 
shall be construed— 
(1) to authorize the promulgation of any regula-
tions not specifically authorized to be issued under 
this title; 
(2) to establish or limit any regulatory authority 
not specifically established or limited under this title; 
or 
(3) to authorize regulatory actions that would 
duplicate or conflict with regulatory requirements, 
mandatory standards, or related processes under an-
other provision of Federal law.
1713 
(m) AUTHORITY OF SECRETARY OF DEFENSE TO RE-
SPOND TO MALICIOUS CYBER ACTIVITY CARRIED OUT BY 
FOREIGN POWERS.—Nothing in this title shall be construed 
to limit the authority of the Secretary of Defense under sec-
tion 130g of title 10, United States Code. 
(n) CRIMINAL PROSECUTION.—Nothing in this title 
shall be construed to prevent the disclosure of a cyber threat 
indicator or defensive measure shared under this title in 
a case of criminal prosecution, when an applicable provi-
sion of Federal, State, tribal, or local law requires disclo-
sure in such case. 
SEC. 109. REPORT ON CYBERSECURITY THREATS. 
(a) REPORT REQUIRED.—Not later than 180 days 
after the date of the enactment of this Act, the Director of 
National Intelligence, in coordination with the heads of 
other appropriate elements of the intelligence community, 
shall submit to the Select Committee on Intelligence of the 
Senate and the Permanent Select Committee on Intelligence 
of the House of Representatives a report on cybersecurity 
threats, including cyber attacks, theft, and data breaches. 
(b) CONTENTS.—The report required by subsection (a) 
shall include the following: 
(1) An assessment of the current intelligence 
sharing and cooperation relationships of the United 
States with other countries regarding cybersecurity
1714 
threats, including cyber attacks, theft, and data 
breaches, directed against the United States and 
which threaten the United States national security 
interests and economy and intellectual property, spe-
cifically identifying the relative utility of such rela-
tionships, which elements of the intelligence commu-
nity participate in such relationships, and whether 
and how such relationships could be improved. 
(2) A list and an assessment of the countries and 
nonstate actors that are the primary threats of car-
rying out a cybersecurity threat, including a cyber 
attack, theft, or data breach, against the United 
States and which threaten the United States national 
security, economy, and intellectual property. 
(3) A description of the extent to which the capa-
bilities of the United States Government to respond to 
or prevent cybersecurity threats, including cyber at-
tacks, theft, or data breaches, directed against the 
United States private sector are degraded by a delay 
in the prompt notification by private entities of such 
threats or cyber attacks, theft, and data breaches. 
(4) An assessment of additional technologies or 
capabilities that would enhance the ability of the 
United States to prevent and to respond to cybersecu-
1715 
rity threats, including cyber attacks, theft, and data 
breaches. 
(5) An assessment of any technologies or prac-
tices utilized by the private sector that could be rap-
idly fielded to assist the intelligence community in 
preventing and responding to cybersecurity threats. 
(c) FORM OF REPORT.—The report required by sub-
section (a) shall be made available in classified and unclas-
sified forms. 
(d) INTELLIGENCE COMMUNITY DEFINED.—In this 
section, the term ‘‘intelligence community’’ has the meaning 
given that term in section 3 of the National Security Act 
of 1947 (50 U.S.C. 3003). 
SEC. 110. EXCEPTION TO LIMITATION ON AUTHORITY OF 
SECRETARY OF DEFENSE TO DISSEMINATE 
CERTAIN INFORMATION. 
Notwithstanding subsection (c)(3) of section 393 of 
title 10, United States Code, the Secretary of Defense may 
authorize the sharing of cyber threat indicators and defen-
sive measures pursuant to the policies, procedures, and 
guidelines developed or issued under this title. 
SEC. 111. EFFECTIVE PERIOD. 
(a) IN GENERAL.—Except as provided in subsection 
(b), this title and the amendments made by this title shall
1716 
be effective during the period beginning on the date of the 
enactment of this Act and ending on September 30, 2025. 
(b) EXCEPTION.—With respect to any action author-
ized by this title or information obtained pursuant to an 
action authorized by this title, which occurred before the 
date on which the provisions referred to in subsection (a) 
cease to have effect, the provisions of this title shall continue 
in effect. 
TITLE II—NATIONAL 
CYBERSECURITY ADVANCEMENT 
Subtitle A—National Cybersecurity 
and 
Communications 
Integra-
tion Center 
SEC. 201. SHORT TITLE. 
This subtitle may be cited as the ‘‘National Cybersecu-
rity Protection Advancement Act of 2015’’. 
SEC. 202. DEFINITIONS. 
In this subtitle: 
(1) 
APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional commit-
tees’’ means— 
(A) the Committee on Homeland Security 
and Governmental Affairs of the Senate; and 
(B) the Committee on Homeland Security of 
the House of Representatives.
1717 
(2) CYBERSECURITY RISK; INCIDENT.—The terms 
‘‘cybersecurity risk’’ and ‘‘incident’’ have the mean-
ings given those terms in section 227 of the Homeland 
Security Act of 2002, as so redesignated by section 
223(a)(3) of this division. 
(3) CYBER
THREAT
INDICATOR; 
DEFENSIVE 
MEASURE.—The terms ‘‘cyber threat indicator’’ and 
‘‘defensive measure’’ have the meanings given those 
terms in section 102. 
(4) DEPARTMENT.—The term ‘‘Department’’ 
means the Department of Homeland Security. 
(5) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Homeland Security. 
SEC. 203. INFORMATION SHARING STRUCTURE AND PROC-
ESSES. 
Section 227 of the Homeland Security Act of 2002, as 
so redesignated by section 223(a)(3) of this division, is 
amended— 
(1) in subsection (a)— 
(A) by redesignating paragraphs (3) and 
(4) as paragraphs (4) and (5), respectively; 
(B) by striking paragraphs (1) and (2) and 
inserting the following: 
‘‘(1) the term ‘cybersecurity risk’—
1718 
‘‘(A) means threats to and vulnerabilities of 
information or information systems and any re-
lated consequences caused by or resulting from 
unauthorized access, use, disclosure, degradation, 
disruption, modification, or destruction of such 
information or information systems, including 
such related consequences caused by an act of 
terrorism; and 
‘‘(B) does not include any action that solely 
involves a violation of a consumer term of service 
or a consumer licensing agreement; 
‘‘(2) the terms ‘cyber threat indicator’ and ‘de-
fensive measure’ have the meanings given those terms 
in section 102 of the Cybersecurity Act of 2015; 
‘‘(3) the term ‘incident’ means an occurrence 
that actually or imminently jeopardizes, without law-
ful authority, the integrity, confidentiality, or avail-
ability of information on an information system, or 
actually or imminently jeopardizes, without lawful 
authority, an information system;’’; 
(C) in paragraph (4), as so redesignated, by 
striking ‘‘and’’ at the end; 
(D) in paragraph (5), as so redesignated, by 
striking the period at the end and inserting ‘‘; 
and’’; and
1719 
(E) by adding at the end the following: 
‘‘(6) the term ‘sharing’ (including all conjuga-
tions thereof) means providing, receiving, and dis-
seminating (including all conjugations of each of such 
terms).’’; 
(2) in subsection (c)— 
(A) in paragraph (1)— 
(i) by inserting ‘‘, including the imple-
mentation of title I of the Cybersecurity Act 
of 2015’’ before the semicolon at the end; 
and 
(ii) by inserting ‘‘cyber threat indica-
tors, defensive measures,’’ before ‘‘cybersecu-
rity risks’’; 
(B) in paragraph (3), by striking ‘‘cyberse-
curity risks’’ and inserting ‘‘cyber threat indica-
tors, defensive measures, cybersecurity risks,’’; 
(C) in paragraph (5)(A), by striking ‘‘cy-
bersecurity risks’’ and inserting ‘‘cyber threat in-
dicators, 
defensive 
measures, 
cybersecurity 
risks,’’; 
(D) in paragraph (6)— 
(i) by striking ‘‘cybersecurity risks’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; and
1720 
(ii) by striking ‘‘and’’ at the end; 
(E) in paragraph (7)— 
(i) in subparagraph (A), by striking 
‘‘and’’ at the end; 
(ii) in subparagraph (B), by striking 
the period at the end and inserting ‘‘; and’’; 
and 
(iii) by adding at the end the fol-
lowing: 
‘‘(C) sharing cyber threat indicators and de-
fensive measures;’’; and 
(F) by adding at the end the following: 
‘‘(8) engaging with international partners, in 
consultation with other appropriate agencies, to— 
‘‘(A) collaborate on cyber threat indicators, 
defensive measures, and information related to 
cybersecurity risks and incidents; and 
‘‘(B) enhance the security and resilience of 
global cybersecurity; 
‘‘(9) sharing cyber threat indicators, defensive 
measures, and other information related to cybersecu-
rity risks and incidents with Federal and non-Fed-
eral entities, including across sectors of critical infra-
structure and with State and major urban area fu-
sion centers, as appropriate;
1721 
‘‘(10) participating, as appropriate, in national 
exercises run by the Department; and 
‘‘(11) in coordination with the Office of Emer-
gency Communications of the Department, assessing 
and evaluating consequence, vulnerability, and threat 
information regarding cyber incidents to public safety 
communications to help facilitate continuous im-
provements to the security and resiliency of such com-
munications.’’; 
(3) in subsection (d)(1)— 
(A) in subparagraph (B)— 
(i) in clause (i), by striking ‘‘and 
local’’ and inserting ‘‘, local, and tribal’’; 
(ii) in clause (ii), by striking ‘‘; and’’ 
and inserting ‘‘, including information 
sharing and analysis centers;’’; 
(iii) in clause (iii), by adding ‘‘and’’ 
at the end; and 
(iv) by adding at the end the following: 
‘‘(iv) private entities;’’. 
(B) in subparagraph (D), by striking ‘‘and’’ 
at the end; 
(C) by redesignating subparagraph (E) as 
subparagraph (F); and
1722 
(D) by inserting after subparagraph (D) the 
following: 
‘‘(E) an entity that collaborates with State 
and local governments on cybersecurity risks and 
incidents, and has entered into a voluntary in-
formation sharing relationship with the Center; 
and’’; 
(4) in subsection (e)— 
(A) in paragraph (1)— 
(i) in subparagraph (A), by inserting 
‘‘cyber threat indicators, defensive measures, 
and’’ before ‘‘information’’; 
(ii) in subparagraph (B), by inserting 
‘‘cyber threat indicators, defensive measures, 
and’’ before ‘‘information related’’; 
(iii) in subparagraph (F)— 
(I) by striking ‘‘cybersecurity 
risks’’ and inserting ‘‘cyber threat in-
dicators, defensive measures, cybersecu-
rity risks,’’; and 
(II) by striking ‘‘and’’ at the end; 
(iv) in subparagraph (G), by striking 
‘‘cybersecurity risks and incidents’’ and in-
serting ‘‘cyber threat indicators, defensive
1723 
measures, cybersecurity risks, and incidents; 
and’’; and 
(v) by adding at the end the following: 
‘‘(H) the Center designates an agency con-
tact for non-Federal entities;’’; 
(B) in paragraph (2)— 
(i) by striking ‘‘cybersecurity risks’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; and 
(ii) by inserting ‘‘or disclosure’’ after 
‘‘access’’; and 
(C) in paragraph (3), by inserting before 
the period at the end the following: ‘‘, including 
by working with the Privacy Officer appointed 
under section 222 to ensure that the Center fol-
lows the policies and procedures specified in sub-
sections (b) and (d)(5)(C) of section 105 of the 
Cybersecurity Act of 2015’’; and 
(5) by adding at the end the following: 
‘‘(g) AUTOMATED INFORMATION SHARING.— 
‘‘(1) IN
GENERAL.—The Under Secretary ap-
pointed under section 103(a)(1)(H), in coordination 
with industry and other stakeholders, shall develop 
capabilities making use of existing information tech-
nology industry standards and best practices, as ap-
1816 
1187), as amended by this Act, is further amended by strik-
ing ‘‘Attorney General’’ each place such term appears (ex-
cept in subsection (c)(11)(B)) and inserting ‘‘Secretary of 
Homeland Security’’. 
(b) ELECTRONIC SYSTEM FOR TRAVEL AUTHORIZA-
TION.—Section 217 of the Immigration and Nationality 
Act (8 U.S.C. 1187), as amended this Act, is further amend-
ed— 
(1) by striking ‘‘electronic travel authorization 
system’’ each place it appears and inserting ‘‘elec-
tronic system for travel authorization’’; 
(2) in the heading in subsection (a)(11), by 
striking ‘‘ELECTRONIC TRAVEL AUTHORIZATION SYS-
TEM’’ and inserting ‘‘ELECTRONIC SYSTEM FOR TRAV-
EL AUTHORIZATION’’; and 
(3) in the heading in subsection (h)(3), by strik-
ing ‘‘ELECTRONIC TRAVEL AUTHORIZATION SYSTEM’’ 
and inserting ‘‘ELECTRONIC SYSTEM FOR TRAVEL AU-
THORIZATION’’. 
SEC. 210. SENSE OF CONGRESS. 
It is the sense of Congress that the International Civil 
Aviation Organization, the specialized agency of the United 
Nations responsible for establishing international stand-
ards, specifications, and best practices related to the admin-
istration and governance of border controls and inspection