I 
116TH CONGRESS 
2D SESSION 
H. R. 5680 
To amend the Homeland Security Act of 2002 to protect United States 
critical infrastructure by ensuring that the Cybersecurity and Infrastruc-
ture Security Agency of the Department of Homeland Security has 
necessary legal tools to notify entities at risk of cybersecurity 
vulnerabilities in the enterprise devices or systems that control critical 
assets of the United States, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 27, 2020 
Mr. LANGEVIN (for himself, Mr. KATKO, Mr. RICHMOND, Mr. THOMPSON of 
Mississippi, and Ms. JACKSON LEE) introduced the following bill; which 
was referred to the Committee on Homeland Security 
A BILL 
To amend the Homeland Security Act of 2002 to protect 
United States critical infrastructure by ensuring that 
the Cybersecurity and Infrastructure Security Agency of 
the Department of Homeland Security has necessary 
legal tools to notify entities at risk of cybersecurity 
vulnerabilities in the enterprise devices or systems that 
control critical assets of the United States, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity Vulner-
ability Identification and Notification Act of 2020’’. 
SEC. 2. SUBPOENA AUTHORITY. 
(a) IN GENERAL.—Section 2209 of the Homeland 
Security Act of 2002 (6 U.S.C. 659) is amended— 
(1) in subsection (a)— 
(A) in this subsection, by inserting ‘‘, ‘cy-
bersecurity purpose’,’’ after ‘‘ ‘cyber threat indi-
cator’ ’’; 
(B) 
by 
redesignating 
paragraphs 
(3) 
through (6) as paragraphs (4) through (7), re-
spectively; 
(C) by inserting after this subsection the 
following new paragraph: 
‘‘(3) the term ‘enterprise device or system’— 
‘‘(A) means a device or information system 
commonly used to perform industrial, commer-
cial, scientific, or governmental functions or 
processes that relate to critical infrastructure, 
including operational and industrial control sys-
tems, distributed control systems, and program-
mable logic controllers; and 
‘‘(B) does not include personal devices and 
systems, such as consumer mobile devices, home 
computers, residential wireless routers, or resi-
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) IN GENERAL.—If the Director identifies an 
information system connected to the internet with a 
specific security vulnerability and has reason to be-
lieve that the security vulnerability relates to critical 
infrastructure and affects an enterprise device or 
system of an entity, and the Director made reason-
able efforts to identify the entity at risk but was un-
able to do so, the Director may issue a subpoena for 
the production of information necessary to identify 
and notify the entity at risk, in order to carry out 
a cybersecurity purpose. 
‘‘(2) LIMIT
ON
INFORMATION.—A subpoena 
issued under this subsection may only seek informa-
tion in the categories set forth in subparagraphs 
(A), (B), (D), and (E) of section 2703(c)(2) of title 
18, United States Code. 
‘‘(3) LIABILITY PROTECTIONS FOR DISCLOSING 
PROVIDERS.—The provisions of section 2703(e) of 
title 18, United States Code, shall apply to any sub-
poena issued under this subsection. 
‘‘(4) COORDINATION.— 
‘‘(A) IN
GENERAL.—Not later than 60 
days after the date of the enactment of this 
subsection, the Director, in coordination with 
the Attorney General, shall develop inter-agency 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
procedures regarding the issuance of subpoenas 
under this subsection in order to avoid inter-
ference with ongoing law enforcement investiga-
tions. To the extent practicable, the Director 
shall coordinate such issuances with the De-
partment of Justice, including the Federal Bu-
reau of Investigation, pursuant to such proce-
dures. 
‘‘(B) CONTENTS.—The inter-agency proce-
dures developed under this paragraph shall pro-
vide that a subpoena issued by the Director 
under this subsection shall be— 
‘‘(i) issued solely in order to carry out 
a cybersecurity purpose; and 
‘‘(ii) subject to the limitations under 
this subsection. 
‘‘(5) NONCOMPLIANCE.—If any person, part-
nership, corporation, association, or entity fails to 
comply with any duly served subpoena issued under 
this subsection, the Director may request that the 
Attorney General seek enforcement of the subpoena 
in any judicial district in which such person, part-
nership, corporation, association, or entity resides, is 
found, or transacts business. 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
‘‘(6) NOTICE.—Not later than seven days after 
the date on which the Director receives information 
obtained through a subpoena issued under this sub-
section, the Director shall notify the entity at risk 
identified by information obtained under the sub-
poena regarding the subpoena and the identified se-
curity vulnerability. 
‘‘(7) AUTHENTICATION.—Any subpoena issued 
by the Director under this subsection shall be au-
thenticated by the electronic signature of an author-
ized representative of the Agency or other com-
parable symbol or process identifying the Agency as 
the source of the subpoena. 
‘‘(8) PROCEDURES.— 
‘‘(A) IN
GENERAL.—Not later than 90 
days after the date of enactment of this sub-
section, the Director shall establish internal 
procedures and associated training, applicable 
to employees and operations of the Agency, re-
garding subpoenas issued under this subsection, 
which shall address the following: 
‘‘(i) The protection of and restriction 
on dissemination of nonpublic information 
obtained through such a subpoena, includ-
ing a requirement that the Agency may not 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
disseminate 
nonpublic 
information 
ob-
tained through such a subpoena that iden-
tifies the party that is subject to such a 
subpoena or the entity at risk identified by 
information obtained as a result of such a 
subpoena, unless— 
‘‘(I) the party or entity consents; 
or 
‘‘(II) the Agency identifies or is 
notified of a cybersecurity incident in-
volving the party or entity, which re-
lates to the security vulnerability 
which led to the issuance of such a 
subpoena. 
‘‘(ii) The restriction on the use of in-
formation obtained through the subpoena 
for a cybersecurity purpose. 
‘‘(iii) The retention and destruction of 
nonpublic information obtained through 
such a subpoena, including the following: 
‘‘(I) Immediate destruction of in-
formation obtained through such a 
subpoena that the Director determines 
is unrelated to critical infrastructure. 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
‘‘(II) Destruction of any person-
ally identifiable information not later 
than six months after the date on 
which the Director receives informa-
tion obtained through such a sub-
poena, unless otherwise agreed to by 
the individual so identified. 
‘‘(iv) The process for recordkeeping 
regarding efforts referred to in paragraph 
(1) undertaken prior to the issuance of 
such a subpoena. 
‘‘(v) The process for tracking engage-
ment with each party that is subject to 
such a subpoena and the entity at risk 
identified by information obtained pursu-
ant to such a subpoena. 
‘‘(vi) The process for providing notice 
to each party that is subject to such a sub-
poena and each entity at risk identified by 
information obtained pursuant to such a 
subpoena. 
‘‘(vii) The process and criteria for 
conducting critical infrastructure security 
risk assessments to determine whether a 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS
subpoena is necessary prior to being so 
issued. 
‘‘(B) CONGRESSIONAL
NOTIFICATION.— 
The Director shall brief the Committee on 
Homeland Security of the House of Representa-
tives and the Committee on Homeland Security 
and Governmental Affairs of the Senate upon 
establishment of internal procedures and associ-
ated training required under this subsection. 
‘‘(9) REVIEW OF PROCEDURES.—Not later than 
one year after the date of enactment of this sub-
section, the Privacy Officer of the Agency, in con-
sultation with the Privacy Officer of the Depart-
ment, shall— 
‘‘(A) review the internal procedures and 
associated training established by the Director 
under paragraph (8) to ensure that— 
‘‘(i) the procedures and training are 
consistent with fair information practices; 
and 
‘‘(ii) the operations of the Agency 
comply with the procedures and training; 
and 
‘‘(B) notify the Committee on Homeland 
Security of the House of Representatives and 
VerDate Sep 11 2014 
00:28 Jan 28, 2020
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5680.IH
H5680
kjohnson on DSK79L0C42PROD with BILLS