Trade Organization that are not justified by ap-
propriate economic and other indicators; and 
(B) treat China as a developed country. 
(d) UNITED NATIONS CLASSIFICATION SYSTEM.— 
The President shall direct the United States Permanent 
Representative to the United Nations to use the voice, 
vote, and influence of the United States— 
(1) to revise the classification system of the 
United Nations Statistics Division necessary to en-
sure the classification of China reflects justifiable 
economic and other indicators; and 
(2) to treat China as a developed country for 
purposes of the Standard Country or Area Codes for 
Statistical Use (Series M, No. 49). 
SEC. 20. PROTECTING AMERICA FROM CYBERATTACKS. 
(a) EXEMPTIONS TO THE COMPUTER FRAUD AND 
ABUSE ACT.—Section 1030 of title 18, United States 
Code, is amended by adding at the end the following: 
‘‘(k) EXCEPTION FOR THE USE OF ATTRIBUTIONAL 
TECHNOLOGY.— 
‘‘(1) IN GENERAL.—This section shall not apply 
with respect to the use of attributional technology in 
regard to a defender who uses a program, code, or 
command for attributional purposes that beacons or 
returns locational or attributional data in response 
VerDate Sep 11 2014 
06:34 Jul 14, 2021
Jkt 019200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H3882.IH
H3882
pbinns on DSKJLVW7X2PROD with BILLS
to a cyber intrusion in order to identify the source 
of an intrusion; if— 
‘‘(A) the program, code, or command origi-
nated on the computer of the defender but is 
copied or removed by an unauthorized user; 
‘‘(B) the program, code, or command does 
not result in the destruction of data or result 
in an impairment of the essential operating 
functionality of the attacker’s computer system, 
or intentionally create a backdoor enabling in-
trusive access into the attacker’s computer sys-
tem; and 
‘‘(C) the defender believes the attacker is 
an agent or an affiliate of Chinese state com-
mercial actors in the United States, other Chi-
nese entities or individuals financed, directed, 
or controlled by the Chinese State, Government 
of China, or the Chinese Communist Party. 
‘‘(2) DEFINITION.—The term ‘attributional 
data’ means any digital information such as log files, 
text strings, time stamps, malware samples, identi-
fiers such as user names and Internet Protocol ad-
dresses and metadata or other digital artifacts gath-
ered through forensic analysis.’’. 
VerDate Sep 11 2014 
06:34 Jul 14, 2021
Jkt 019200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H3882.IH
H3882
pbinns on DSKJLVW7X2PROD with BILLS
(b) EXCLUSION FROM PROSECUTION FOR CERTAIN 
COMPUTER CRIMES FOR THOSE TAKING ACTIVE CYBER 
DEFENSE MEASURES.—Section 1030 of title 18, United 
States Code, is amended by adding at the end the fol-
lowing: 
‘‘(l) ACTIVE CYBER DEFENSE MEASURES NOT A 
VIOLATION.— 
‘‘(1) IN GENERAL.—It is a defense to a crimi-
nal prosecution under this section that the conduct 
constituting the offense was an active cyber defense 
measure if the defender believes the attacker was an 
agent or an affiliate of Chinese state commercial ac-
tors in the United States, other Chinese entities or 
individuals financed, directed, or controlled by the 
Chinese State, the Government of China, or the Chi-
nese Communist Party. 
‘‘(2) DEFINITIONS.—In this subsection— 
‘‘(A) the term ‘defender’ means a person 
or an entity that is a victim of a persistent un-
authorized intrusion of the individual entity’s 
computer; 
‘‘(B) the term ‘active cyber defense meas-
ure’— 
‘‘(i) means any measure— 
VerDate Sep 11 2014 
06:34 Jul 14, 2021
Jkt 019200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H3882.IH
H3882
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(I) undertaken by, or at the di-
rection of, a defender; and 
‘‘(II) 
consisting 
of 
accessing 
without authorization the computer of 
the attacker to the defender’s own 
network to gather information in 
order to— 
‘‘(aa) establish attribution of 
criminal activity to share with 
law 
enforcement 
and 
other 
United States Government agen-
cies responsible for cybersecurity; 
‘‘(bb) disrupt continued un-
authorized activity against the 
defender’s own network; or 
‘‘(cc) monitor the behavior 
of an attacker to assist in devel-
oping future intrusion prevention 
or cyber defense techniques; but 
‘‘(ii) does not include conduct that— 
‘‘(I) intentionally destroys or ren-
ders inoperable information that does 
not belong to the victim that is stored 
on another person or entity’s com-
puter; 
VerDate Sep 11 2014 
06:34 Jul 14, 2021
Jkt 019200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H3882.IH
H3882
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(II) recklessly causes physical 
injury or financial loss as described 
under subsection (c)(4); 
‘‘(III) creates a threat to the 
public health or safety; 
‘‘(IV) intentionally exceeds the 
level of activity required to perform 
reconnaissance on an intermediary 
computer to allow for attribution of 
the origin of the persistent cyber in-
trusion; 
‘‘(V) intentionally results in in-
trusive or remote access into an 
intermediary’s computer; 
‘‘(VI) intentionally results in the 
persistent disruption to a person or 
entities internet connectivity resulting 
in damages defined under subsection 
(c)(4); or 
‘‘(VII) impacts any computer de-
scribed under subsection (a)(1) re-
garding access to national security in-
formation, subsection (a)(3) regarding 
government computers, or to sub-
section (c)(4)(A)(i)(V) regarding a 
VerDate Sep 11 2014 
06:34 Jul 14, 2021
Jkt 019200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H3882.IH
H3882
pbinns on DSKJLVW7X2PROD with BILLS
computer system used by or for a 
Government entity for the furtherance 
of the administration of justice, na-
tional defense, or national security; 
‘‘(C) the term ‘attacker’ means a person or 
an entity that is the source of the persistent un-
authorized intrusion into the victim’s computer; 
and 
‘‘(D) the term ‘intermediary computer’ 
means a person or entity’s computer that is not 
under the ownership or primary control of the 
attacker but has been used to launch or obscure 
the origin of the persistent cyber-attack.’’. 
(c) NOTIFICATION REQUIREMENT FOR THE USE OF 
ACTIVE CYBER DEFENSE MEASURES.—Section 1030 of 
title 18, United States Code, is amended by adding the 
following: 
‘‘(m) NOTIFICATION REQUIREMENT FOR THE USE 
OF ACTIVE CYBER DEFENSE MEASURES.— 
‘‘(1) IN GENERAL.—A defender who uses an ac-
tive cyber defense measure under the preceding sec-
tion must notify the FBI National Cyber Investiga-
tive Joint Task Force and either receive a response 
from the FBI acknowledging receipt of the notifica-
tion or wait 48 hours prior to using the measure. 
VerDate Sep 11 2014 
06:34 Jul 14, 2021
Jkt 019200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H3882.IH
H3882
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(2) REQUIRED
NOTIFICATION.—Notification 
must include the type of cyber breach that the per-
son or entity was a victim of, the intended target of 
the active cyber defense measure, the steps the de-
fender plans to take to preserve evidence of the 
attacker’s criminal cyber intrusion, as well as the 
steps they plan to prevent damage to intermediary 
computers not under the ownership of the attacker 
and other information requested by the FBI to as-
sist with oversight.’’. 
Æ 
VerDate Sep 11 2014 
06:34 Jul 14, 2021
Jkt 019200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6301
E:\BILLS\H3882.IH
H3882
pbinns on DSKJLVW7X2PROD with BILLS