II 
114TH CONGRESS 
1ST SESSION H. R. 1560 
IN THE SENATE OF THE UNITED STATES 
APRIL 27, 2015 
Received 
AN ACT 
To improve cybersecurity in the United States through en-
hanced sharing of information about cybersecurity 
threats, to amend the Homeland Security Act of 2002 
to enhance multi-directional sharing of information re-
lated to cybersecurity risks and strengthen privacy and 
civil liberties protections, and for other purposes. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. TABLE OF CONTENTS. 
The table of contents of this Act is as follows: 
Sec. 1. Table of Contents. 
TITLE I—PROTECTING CYBER NETWORKS ACT 
Sec. 101. Short title. 
Sec. 102. Sharing of cyber threat indicators and defensive measures by the 
Federal Government with non-Federal entities. 
Sec. 103. Authorizations for preventing, detecting, analyzing, and mitigating 
cybersecurity threats. 
Sec. 104. Sharing of cyber threat indicators and defensive measures with ap-
propriate Federal entities other than the Department of De-
fense or the National Security Agency. 
Sec. 105. Federal Government liability for violations of privacy or civil liberties. 
Sec. 106. Protection from liability. 
Sec. 107. Oversight of Government activities. 
Sec. 108. Report on cybersecurity threats. 
Sec. 109. Construction and preemption. 
Sec. 110. Definitions. 
Sec. 111. Comptroller General report on removal of personal identifying infor-
mation. 
Sec. 112. Sunset. 
TITLE II—NATIONAL CYBERSECURITY PROTECTION 
ADVANCEMENT ACT 
Sec. 201. Short title. 
Sec. 202. National Cybersecurity and Communications Integration Center. 
Sec. 203. Information sharing structure and processes. 
Sec. 204. Information sharing and analysis organizations. 
Sec. 205. Streamlining of Department of Homeland Security cybersecurity and 
infrastructure protection organization. 
Sec. 206. Cyber incident response plans. 
Sec. 207. Security and resiliency of public safety communications; Cybersecu-
rity awareness campaign. 
Sec. 208. Critical infrastructure protection research and development. 
Sec. 209. Report on reducing cybersecurity risks in DHS data centers. 
Sec. 210. Assessment. 
Sec. 211. Consultation. 
Sec. 212. Technical assistance. 
Sec. 213. Prohibition on new regulatory authority. 
Sec. 214. Sunset. 
Sec. 215. Prohibition on new funding. 
Sec. 216. Protection of Federal information systems. 
Sec. 217. Sunset. 
Sec. 218. Report on cybersecurity vulnerabilities of United States ports. 
Sec. 219. Report on cybersecurity and critical infrastructure. 
Sec. 220. GAO report on impact privacy and civil liberties. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
TITLE I—PROTECTING CYBER 
NETWORKS ACT 
SEC. 101. SHORT TITLE. 
This title may be cited as the ‘‘Protecting Cyber Net-
works Act’’. 
SEC. 102. SHARING OF CYBER THREAT INDICATORS AND 
DEFENSIVE MEASURES BY THE FEDERAL 
GOVERNMENT WITH NON-FEDERAL ENTITIES. 
(a) IN GENERAL.—Title I of the National Security 
Act of 1947 (50 U.S.C. 3021 et seq.) is amended by in-
serting after section 110 (50 U.S.C. 3045) the following 
new section: 
‘‘SEC. 111. SHARING OF CYBER THREAT INDICATORS AND 
DEFENSIVE MEASURES BY THE FEDERAL 
GOVERNMENT WITH NON-FEDERAL ENTITIES. 
‘‘(a) SHARING BY THE FEDERAL GOVERNMENT.— 
‘‘(1) IN GENERAL.—Consistent with the protec-
tion of classified information, intelligence sources 
and methods, and privacy and civil liberties, the Di-
rector of National Intelligence, in consultation with 
the heads of the other appropriate Federal entities, 
shall develop and promulgate procedures to facilitate 
and promote— 
‘‘(A) the timely sharing of classified cyber 
threat indicators in the possession of the Fed-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
eral Government with representatives of rel-
evant non-Federal entities with appropriate se-
curity clearances; 
‘‘(B) the timely sharing with relevant non- 
Federal entities of cyber threat indicators in the 
possession of the Federal Government that may 
be declassified and shared at an unclassified 
level; and 
‘‘(C) the sharing with non-Federal entities, 
if appropriate, of information in the possession 
of the Federal Government about imminent or 
ongoing cybersecurity threats to such entities to 
prevent or mitigate adverse impacts from such 
cybersecurity threats. 
‘‘(2) DEVELOPMENT
OF
PROCEDURES.—The 
procedures developed and promulgated under para-
graph (1) shall— 
‘‘(A) ensure the Federal Government has 
and maintains the capability to share cyber 
threat indicators in real time consistent with 
the protection of classified information; 
‘‘(B) incorporate, to the greatest extent 
practicable, existing processes and existing roles 
and responsibilities of Federal and non-Federal 
entities for information sharing by the Federal 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
Government, including sector-specific informa-
tion sharing and analysis centers; 
‘‘(C) include procedures for notifying non- 
Federal entities that have received a cyber 
threat indicator from a Federal entity under 
this Act that is known or determined to be in 
error or in contravention of the requirements of 
this section, the Protecting Cyber Networks 
Act, or the amendments made by such Act or 
another provision of Federal law or policy of 
such error or contravention; 
‘‘(D) include requirements for Federal en-
tities receiving a cyber threat indicator or de-
fensive measure to implement appropriate secu-
rity controls to protect against unauthorized ac-
cess to, or acquisition of, such cyber threat in-
dicator or defensive measure; 
‘‘(E) include procedures that require Fed-
eral entities, prior to the sharing of a cyber 
threat indicator, to— 
‘‘(i) review such cyber threat indicator 
to assess whether such cyber threat indi-
cator, in contravention of the requirement 
under section 3(d)(2) of the Protecting 
Cyber Networks Act, contains any infor-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
mation that such Federal entity knows at 
the time of sharing to be personal informa-
tion of or information identifying a specific 
person not directly related to a cybersecu-
rity threat and remove such information; 
or 
‘‘(ii) implement a technical capability 
configured to remove or exclude any per-
sonal information of or information identi-
fying a specific person not directly related 
to a cybersecurity threat; and 
‘‘(F) include procedures to promote the ef-
ficient granting of security clearances to appro-
priate representatives of non-Federal entities. 
‘‘(b) DEFINITIONS.—In this section, the terms ‘ap-
propriate Federal entities’, ‘cyber threat indicator’, ‘defen-
sive measure’, ‘Federal entity’, and ‘non-Federal entity’ 
have the meaning given such terms in section 11 of the 
Protecting Cyber Networks Act.’’. 
(b) SUBMITTAL TO CONGRESS.—Not later than 90 
days after the date of the enactment of this title, the Di-
rector of National Intelligence, in consultation with the 
heads of the other appropriate Federal entities, shall sub-
mit to Congress the procedures required by section 111(a) 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
of the National Security Act of 1947, as inserted by sub-
section (a) of this section. 
(c) TABLE OF CONTENTS AMENDMENT.—The table 
of contents in the first section of the National Security 
Act of 1947 is amended by inserting after the item relat-
ing to section 110 the following new item: 
‘‘Sec. 111. Sharing of cyber threat indicators and defensive measures by the 
Federal Government with non-Federal entities.’’. 
SEC. 103. AUTHORIZATIONS FOR PREVENTING, DETECTING, 
ANALYZING, AND MITIGATING CYBERSECU-
RITY THREATS. 
(a) AUTHORIZATION FOR PRIVATE-SECTOR DEFEN-
SIVE MONITORING.— 
(1) IN GENERAL.—Notwithstanding any other 
provision of law, a private entity may, for a cyberse-
curity purpose, monitor— 
(A) an information system of such private 
entity; 
(B) an information system of a non-Fed-
eral entity or a Federal entity, upon the written 
authorization of such non-Federal entity or 
such Federal entity; and 
(C) information that is stored on, proc-
essed by, or transiting an information system 
monitored by the private entity under this para-
graph. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
such private entity, such non-Federal entity, or 
such Federal entity. 
(2) LIMITATION.—The authority provided in 
paragraph (1) does not include a defensive measure 
that destroys, renders unusable or inaccessible (in 
whole or in part), or substantially harms an infor-
mation system or information stored on, processed 
by, or transiting such information system not owned 
by— 
(A) the private entity operating such de-
fensive measure; or 
(B) a non-Federal entity or a Federal enti-
ty that has provided written authorization to 
that private entity for operation of such defen-
sive measure on the information system or in-
formation of the entity in accordance with this 
subsection. 
(3) CONSTRUCTION.—Nothing in this sub-
section shall be construed— 
(A) to authorize the use of a defensive 
measure other than as provided in this sub-
section; or 
(B) to limit otherwise lawful activity. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(c) AUTHORIZATION FOR SHARING OR RECEIVING 
CYBER
THREAT
INDICATORS
OR
DEFENSIVE
MEAS-
URES.— 
(1) IN GENERAL.—Except as provided in para-
graph (2) and notwithstanding any other provision 
of law, a non-Federal entity may, for a cybersecurity 
purpose and consistent with the requirement under 
subsection (d)(2) to remove personal information of 
or information identifying a specific person not di-
rectly related to a cybersecurity threat and the pro-
tection of classified information— 
(A) share a lawfully obtained cyber threat 
indicator or defensive measure with any other 
non-Federal entity or an appropriate Federal 
entity (other than the Department of Defense 
or any component of the Department, including 
the National Security Agency); and 
(B) receive a cyber threat indicator or de-
fensive measure from any other non-Federal en-
tity or an appropriate Federal entity. 
(2) LAWFUL RESTRICTION.—A non-Federal en-
tity receiving a cyber threat indicator or defensive 
measure from another non-Federal entity or a Fed-
eral entity shall comply with otherwise lawful restric-
tions placed on the sharing or use of such cyber 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
threat indicator or defensive measure by the sharing 
non-Federal entity or Federal entity. 
(3) CONSTRUCTION.—Nothing in this sub-
section shall be construed to— 
(A) authorize the sharing or receiving of a 
cyber threat indicator or defensive measure 
other than as provided in this subsection; 
(B) authorize the sharing or receiving of 
classified information by or with any person not 
authorized to access such classified information; 
(C) prohibit any Federal entity from en-
gaging in formal or informal technical discus-
sion regarding cyber threat indicators or defen-
sive measures with a non-Federal entity or from 
providing 
technical 
assistance 
to 
address 
vulnerabilities or mitigate threats at the request 
of such an entity; 
(D) limit otherwise lawful activity; 
(E) prohibit otherwise lawful sharing by a 
non-Federal entity of a cyber threat indicator 
or defensive measure with the Department of 
Defense or any component of the Department, 
including the National Security Agency; or 
(F) authorize the Federal Government to 
conduct surveillance of any person. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(d) PROTECTION AND USE OF INFORMATION.— 
(1) SECURITY OF INFORMATION.—A non-Fed-
eral entity monitoring an information system, oper-
ating a defensive measure, or providing or receiving 
a cyber threat indicator or defensive measure under 
this section shall implement an appropriate security 
control to protect against unauthorized access to, or 
acquisition of, such cyber threat indicator or defen-
sive measure. 
(2) REMOVAL OF CERTAIN PERSONAL INFORMA-
TION.—A non-Federal entity sharing a cyber threat 
indicator pursuant to this title shall, prior to such 
sharing, take reasonable efforts to— 
(A) review such cyber threat indicator to 
assess whether such cyber threat indicator con-
tains any information that the non-Federal en-
tity reasonably believes at the time of sharing 
to be personal information of or information 
identifying a specific person not directly related 
to a cybersecurity threat and remove such infor-
mation; or 
(B) implement a technical capability con-
figured to remove any information contained 
within such indicator that the non-Federal enti-
ty reasonably believes at the time of sharing to 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
be personal information of or information iden-
tifying a specific person not directly related to 
a cybersecurity threat. 
(3) USE OF CYBER THREAT INDICATORS AND 
DEFENSIVE
MEASURES
BY
NON-FEDERAL
ENTI-
TIES.—A non-Federal entity may, for a cybersecu-
rity purpose— 
(A) use a cyber threat indicator or defen-
sive measure shared or received under this sec-
tion to monitor or operate a defensive measure 
on— 
(i) an information system of such non- 
Federal entity; or 
(ii) an information system of another 
non-Federal entity or a Federal entity 
upon the written authorization of that 
other non-Federal entity or that Federal 
entity; and 
(B) otherwise use, retain, and further 
share such cyber threat indicator or defensive 
measure subject to— 
(i) an otherwise lawful restriction 
placed by the sharing non-Federal entity 
or Federal entity on such cyber threat in-
dicator or defensive measure; or 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(ii) an otherwise applicable provision 
of law. 
(4) USE
OF
CYBER
THREAT
INDICATORS
BY 
STATE, TRIBAL, OR LOCAL GOVERNMENT.— 
(A) LAW
ENFORCEMENT
USE.—A State, 
tribal, or local government may use a cyber 
threat indicator shared with such State, tribal, 
or local government for the purposes described 
in clauses (i), (ii), and (iii) of section 
104(d)(5)(A). 
(B) EXEMPTION
FROM
DISCLOSURE.—A 
cyber threat indicator or defensive measure 
shared with a State, tribal, or local government 
under this section shall be— 
(i) deemed voluntarily shared informa-
tion; and 
(ii) exempt from disclosure under any 
State, tribal, or local law requiring disclo-
sure of information or records, except as 
otherwise required by applicable State, 
tribal, or local law requiring disclosure in 
any criminal prosecution. 
(e) NO RIGHT OR BENEFIT.—The sharing of a cyber 
threat indicator with a non-Federal entity under this title 
shall not create a right or benefit to similar information 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
by such non-Federal entity or any other non-Federal enti-
ty. 
(f) SMALL BUSINESS PARTICIPATION.— 
(1) ASSISTANCE.—The Administrator of the 
Small Business Administration shall provide assist-
ance to small businesses and small financial institu-
tions to monitor information and information sys-
tems, operate defensive measures, and share and re-
ceive cyber threat indicators and defensive measures 
under this section. 
(2) REPORT.—Not later than 1 year after the 
date of the enactment of this title, the Administrator 
of the Small Business Administration shall submit 
to the President a report on the degree to which 
small businesses and small financial institutions are 
able to engage in cyber threat information sharing 
under this section. Such report shall include the rec-
ommendations of the Administrator for improving 
the ability of such businesses and institutions to en-
gage in cyber threat information sharing and to use 
shared information to defend their networks. 
(3) 
OUTREACH.—The 
Federal 
Government 
shall conduct outreach to small businesses and small 
financial institutions to encourage such businesses 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
and institutions to exercise their authority under 
this section. 
SEC. 104. SHARING OF CYBER THREAT INDICATORS AND 
DEFENSIVE MEASURES WITH APPROPRIATE 
FEDERAL ENTITIES OTHER THAN THE DE-
PARTMENT OF DEFENSE OR THE NATIONAL 
SECURITY AGENCY. 
(a) REQUIREMENT
FOR
POLICIES
AND
PROCE-
DURES.— 
(1) IN GENERAL.—Section 111 of the National 
Security Act of 1947, as inserted by section 102 of 
this title, is amended— 
(A) by redesignating subsection (b) as sub-
section (c); and 
(B) by inserting after subsection (a) the 
following new subsection: 
‘‘(b) POLICIES
AND PROCEDURES
FOR SHARING 
WITH
THE APPROPRIATE FEDERAL ENTITIES OTHER 
THAN
THE DEPARTMENT
OF DEFENSE
OR
THE NA-
TIONAL SECURITY AGENCY.— 
‘‘(1) ESTABLISHMENT.—The President shall 
develop and submit to Congress policies and proce-
dures relating to the receipt of cyber threat indica-
tors and defensive measures by the Federal Govern-
ment. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(2) REQUIREMENTS
CONCERNING
POLICIES 
AND PROCEDURES.—The policies and procedures re-
quired under paragraph (1) shall— 
‘‘(A) be developed in accordance with the 
privacy and civil liberties guidelines required 
under section 4(b) of the Protecting Cyber Net-
works Act; 
‘‘(B) ensure that— 
‘‘(i) a cyber threat indicator shared by 
a non-Federal entity with an appropriate 
Federal entity (other than the Department 
of Defense or any component of the De-
partment, including the National Security 
Agency) pursuant to section 3 of such Act 
is shared in real-time with all of the appro-
priate Federal entities (including all rel-
evant components thereof); 
‘‘(ii) the sharing of such cyber threat 
indicator with appropriate Federal entities 
is not subject to any delay, modification, or 
any other action without good cause that 
could impede receipt by all of the appro-
priate Federal entities; and 
‘‘(iii) such cyber threat indicator is 
provided to each other Federal entity to 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
which such cyber threat indicator is rel-
evant; and 
‘‘(C) ensure there— 
‘‘(i) is an audit capability; and 
‘‘(ii) are appropriate sanctions in 
place for officers, employees, or agents of 
a Federal entity who knowingly and will-
fully use a cyber threat indicator or de-
fense measure shared with the Federal 
Government by a non-Federal entity under 
the Protecting Cyber Networks Act other 
than in accordance with this section and 
such Act.’’. 
(2) SUBMISSION.—The President shall submit 
to Congress— 
(A) not later than 90 days after the date 
of the enactment of this title, interim policies 
and 
procedures 
required 
under 
section 
111(b)(1) of the National Security Act of 1947, 
as inserted by paragraph (1) of this section; 
and 
(B) not later than 180 days after such 
date, final policies and procedures required 
under such section 111(b)(1). 
(b) PRIVACY AND CIVIL LIBERTIES.— 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(1) GUIDELINES OF ATTORNEY GENERAL.—The 
Attorney General, in consultation with the heads of 
the other appropriate Federal agencies and with offi-
cers designated under section 1062 of the Intel-
ligence Reform and Terrorism Prevention Act of 
2004 (42 U.S.C. 2000ee–1), shall develop and peri-
odically review guidelines relating to privacy and 
civil liberties that govern the receipt, retention, use, 
and dissemination of cyber threat indicators by a 
Federal entity obtained in accordance with this title 
and the amendments made by this title. 
(2) CONTENT.—The guidelines developed and 
reviewed under paragraph (1) shall, consistent with 
the need to protect information systems from cyber-
security threats and mitigate cybersecurity threats— 
(A) limit the impact on privacy and civil 
liberties of activities by the Federal Government 
under this title, including guidelines to ensure 
that personal information of or information 
identifying specific persons is properly removed 
from information received, retained, used, or 
disseminated by a Federal entity in accordance 
with this title or the amendments made by this 
title; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(B) limit the receipt, retention, use, and 
dissemination of cyber threat indicators con-
taining personal information of or information 
identifying specific persons, including by estab-
lishing— 
(i) a process for the prompt destruc-
tion of such information that is known not 
to be directly related to a use for a cyber-
security purpose; 
(ii) specific limitations on the length 
of any period in which a cyber threat indi-
cator may be retained; and 
(iii) a process to inform recipients 
that such indicators may only be used for 
a cybersecurity purpose; 
(C) include requirements to safeguard 
cyber threat indicators containing personal in-
formation of or identifying specific persons 
from unauthorized access or acquisition, includ-
ing appropriate sanctions for activities by offi-
cers, employees, or agents of the Federal Gov-
ernment in contravention of such guidelines; 
(D) include procedures for notifying non- 
Federal entities and Federal entities if informa-
tion received pursuant to this section is known 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
or determined by a Federal entity receiving 
such information not to constitute a cyber 
threat indicator; 
(E) be consistent with any other applicable 
provisions of law and the fair information prac-
tice principles set forth in appendix A of the 
document entitled ‘‘National Strategy for 
Trusted Identities in Cyberspace’’ and pub-
lished by the President in April, 2011; and 
(F) include steps that may be needed so 
that dissemination of cyber threat indicators is 
consistent with the protection of classified infor-
mation and other sensitive national security in-
formation. 
(3) SUBMISSION.—The Attorney General shall 
submit to Congress— 
(A) not later than 90 days after the date 
of the enactment of this title, interim guidelines 
required under paragraph (1); and 
(B) not later than 180 days after such 
date, final guidelines required under such para-
graph. 
(c) NATIONAL CYBER THREAT INTELLIGENCE INTE-
GRATION CENTER.— 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(1) ESTABLISHMENT.—Title I of the National 
Security Act of 1947 (50 U.S.C. 3021 et seq.), as 
amended by section 102 of this title, is further 
amended— 
(A) by redesignating section 119B as sec-
tion 119C; and 
(B) by inserting after section 119A the fol-
lowing new section: 
‘‘SEC. 119B. CYBER THREAT INTELLIGENCE INTEGRATION 
CENTER. 
‘‘(a) ESTABLISHMENT.—There is within the Office of 
the Director of National Intelligence a Cyber Threat Intel-
ligence Integration Center. 
‘‘(b) DIRECTOR.—There is a Director of the Cyber 
Threat Intelligence Integration Center, who shall be the 
head of the Cyber Threat Intelligence Integration Center, 
and who shall be appointed by the Director of National 
Intelligence. 
‘‘(c) PRIMARY MISSIONS.—The Cyber Threat Intel-
ligence Integration Center shall— 
‘‘(1) serve as the primary organization within 
the Federal Government for analyzing and inte-
grating all intelligence possessed or acquired by the 
United States pertaining to cyber threats; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(2) ensure that appropriate departments and 
agencies have full access to and receive all-source in-
telligence support needed to execute the cyber threat 
intelligence activities of such agencies and to per-
form independent, alternative analyses; 
‘‘(3) disseminate cyber threat analysis to the 
President, the appropriate departments and agencies 
of the Federal Government, and the appropriate 
committees of Congress; 
‘‘(4) coordinate cyber threat intelligence activi-
ties of the departments and agencies of the Federal 
Government; and 
‘‘(5) conduct strategic cyber threat intelligence 
planning for the Federal Government. 
‘‘(d) LIMITATIONS.—The Cyber Threat Intelligence 
Integration Center shall— 
‘‘(1) have not more than 50 permanent posi-
tions; 
‘‘(2) in carrying out the primary missions of the 
Center described in subsection (c), may not augment 
staffing through detailees, assignees, or core con-
tractor personnel or enter into any personal services 
contracts to exceed the limitation under paragraph 
(1); and 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(3) be located in a building owned or operated 
by an element of the intelligence community as of 
the date of the enactment of this section.’’. 
(2) TABLE OF CONTENTS AMENDMENTS.—The 
table of contents in the first section of the National 
Security Act of 1947, as amended by section 102 of 
this title, is further amended by striking the item re-
lating to section 119B and inserting the following 
new items: 
‘‘Sec. 119B. Cyber Threat Intelligence Integration Center. 
‘‘Sec. 119C. National intelligence centers.’’. 
(d) INFORMATION SHARED WITH OR PROVIDED TO 
THE FEDERAL GOVERNMENT.— 
(1) NO
WAIVER
OF
PRIVILEGE
OR
PROTEC-
TION.—The provision of a cyber threat indicator or 
defensive measure to the Federal Government under 
this title shall not constitute a waiver of any applica-
ble privilege or protection provided by law, including 
trade secret protection. 
(2) PROPRIETARY
INFORMATION.—Consistent 
with this title, a cyber threat indicator or defensive 
measure provided by a non-Federal entity to the 
Federal Government under this title shall be consid-
ered the commercial, financial, and proprietary in-
formation of the non-Federal entity that is the origi-
nator of such cyber threat indicator or defensive 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
measure when so designated by such non-Federal 
entity or a non-Federal entity acting in accordance 
with the written authorization of the non-Federal 
entity that is the originator of such cyber threat in-
dicator or defensive measure. 
(3) EXEMPTION FROM DISCLOSURE.—A cyber 
threat indicator or defensive measure provided to the 
Federal Government under this title shall be— 
(A) deemed voluntarily shared information 
and exempt from disclosure under section 552 
of title 5, United States Code, and any State, 
tribal, or local law requiring disclosure of infor-
mation or records; and 
(B) withheld, without discretion, from the 
public under section 552(b)(3) of title 5, United 
States Code, and any State, tribal, or local pro-
vision of law requiring disclosure of information 
or records, except as otherwise required by ap-
plicable Federal, State, tribal, or local law re-
quiring disclosure in any criminal prosecution. 
(4) EX PARTE COMMUNICATIONS.—The provi-
sion of a cyber threat indicator or defensive measure 
to the Federal Government under this title shall not 
be subject to a rule of any Federal department or 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
agency or any judicial doctrine regarding ex parte 
communications with a decision-making official. 
(5) DISCLOSURE, RETENTION, AND USE.— 
(A) AUTHORIZED
ACTIVITIES.—A cyber 
threat indicator or defensive measure provided 
to the Federal Government under this title may 
be disclosed to, retained by, and used by, con-
sistent with otherwise applicable provisions of 
Federal law, any department, agency, compo-
nent, officer, employee, or agent of the Federal 
Government solely for— 
(i) a cybersecurity purpose; 
(ii) the purpose of responding to, in-
vestigating, prosecuting, or otherwise pre-
venting or mitigating a threat of death or 
serious bodily harm or an offense arising 
out of such a threat; 
(iii) the purpose of responding to, in-
vestigating, prosecuting, or otherwise pre-
venting or mitigating, a serious threat to a 
minor, including sexual exploitation and 
threats to physical safety; or 
(iv) the purpose of preventing, inves-
tigating, disrupting, or prosecuting any of 
the offenses listed in sections 1028, 1029, 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
1030, and 3559(c)(2)(F) and chapters 37 
and 90 of title 18, United States Code. 
(B) PROHIBITED
ACTIVITIES.—A cyber 
threat indicator or defensive measure provided 
to the Federal Government under this title shall 
not be disclosed to, retained by, or used by any 
Federal department or agency for any use not 
permitted under subparagraph (A). 
(C) PRIVACY
AND
CIVIL
LIBERTIES.—A 
cyber threat indicator or defensive measure pro-
vided to the Federal Government under this 
title shall be retained, used, and disseminated 
by the Federal Government in accordance 
with— 
(i) the policies and procedures relating 
to the receipt of cyber threat indicators 
and defensive measures by the Federal 
Government required by subsection (b) of 
section 111 of the National Security Act of 
1947, as added by subsection (a) of this 
section; and 
(ii) the privacy and civil liberties 
guidelines required by subsection (b). 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
SEC. 105. FEDERAL GOVERNMENT LIABILITY FOR VIOLA-
TIONS OF PRIVACY OR CIVIL LIBERTIES. 
(a) IN GENERAL.—If a department or agency of the 
Federal Government intentionally or willfully violates the 
privacy and civil liberties guidelines issued by the Attorney 
General under section 104(b), the United States shall be 
liable to a person injured by such violation in an amount 
equal to the sum of— 
(1) the actual damages sustained by the person 
as a result of the violation or $1,000, whichever is 
greater; and 
(2) reasonable attorney fees as determined by 
the court and other litigation costs reasonably in-
curred in any case under this subsection in which 
the complainant has substantially prevailed. 
(b) VENUE.—An action to enforce liability created 
under this section may be brought in the district court 
of the United States in— 
(1) the district in which the complainant re-
sides; 
(2) the district in which the principal place of 
business of the complainant is located; 
(3) the district in which the department or 
agency of the Federal Government that violated such 
privacy and civil liberties guidelines is located; or 
(4) the District of Columbia. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(c) STATUTE OF LIMITATIONS.—No action shall lie 
under this section unless such action is commenced not 
later than 2 years after the date on which the cause of 
action arises. 
(d) EXCLUSIVE CAUSE OF ACTION.—A cause of ac-
tion under this section shall be the exclusive means avail-
able to a complainant seeking a remedy for a violation by 
a department or agency of the Federal Government under 
this title. 
SEC. 106. PROTECTION FROM LIABILITY. 
(a) MONITORING OF INFORMATION SYSTEMS.—No 
cause of action shall lie or be maintained in any court 
against any private entity, and such action shall be 
promptly dismissed, for the monitoring of an information 
system and information under section 103(a) that is con-
ducted in accordance with this title and the amendments 
made by this title. 
(b) SHARING OR RECEIPT OF CYBER THREAT INDI-
CATORS.—No cause of action shall lie or be maintained 
in any court against any non-Federal entity, and such ac-
tion shall be promptly dismissed, for the sharing or receipt 
of a cyber threat indicator or defensive measure under sec-
tion 103(c), or a good faith failure to act based on such 
sharing or receipt, if such sharing or receipt is conducted 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
in accordance with this title and the amendments made 
by this title. 
(c) WILLFUL MISCONDUCT.— 
(1) RULE OF CONSTRUCTION.—Nothing in this 
section shall be construed— 
(A) to require dismissal of a cause of ac-
tion against a non-Federal entity (including a 
private entity) that has engaged in willful mis-
conduct in the course of conducting activities 
authorized by this title or the amendments 
made by this title; or 
(B) to undermine or limit the availability 
of otherwise applicable common law or statu-
tory defenses. 
(2) PROOF OF WILLFUL MISCONDUCT.—In any 
action claiming that subsection (a) or (b) does not 
apply due to willful misconduct described in para-
graph (1), the plaintiff shall have the burden of 
proving by clear and convincing evidence the willful 
misconduct by each non-Federal entity subject to 
such claim and that such willful misconduct proxi-
mately caused injury to the plaintiff. 
(3) WILLFUL MISCONDUCT DEFINED.—In this 
subsection, the term ‘‘willful misconduct’’ means an 
act or omission that is taken— 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
(A) intentionally to achieve a wrongful 
purpose; 
(B) knowingly without legal or factual jus-
tification; and 
(C) in disregard of a known or obvious risk 
that is so great as to make it highly probable 
that the harm will outweigh the benefit. 
SEC. 107. OVERSIGHT OF GOVERNMENT ACTIVITIES. 
(a) BIENNIAL REPORT ON IMPLEMENTATION.— 
(1) IN GENERAL.—Section 111 of the National 
Security Act of 1947, as added by section 102(a) 
and amended by section 104(a) of this title, is fur-
ther amended— 
(A) by redesignating subsection (c) (as re-
designated by such section 104(a)) as sub-
section (d); and 
(B) by inserting after subsection (b) (as 
inserted by such section 104(a)) the following 
new subsection: 
‘‘(c) BIENNIAL REPORT ON IMPLEMENTATION.— 
‘‘(1) IN GENERAL.—Not less frequently than 
once every two years, the Director of National Intel-
ligence, in consultation with the heads of the other 
appropriate Federal entities, shall submit to Con-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
gress a report concerning the implementation of this 
section and the Protecting Cyber Networks Act. 
‘‘(2) CONTENTS.—Each report submitted under 
paragraph (1) shall include the following: 
‘‘(A) An assessment of the sufficiency of 
the policies, procedures, and guidelines required 
by this section and section 4 of the Protecting 
Cyber Networks Act in ensuring that cyber 
threat indicators are shared effectively and re-
sponsibly within the Federal Government. 
‘‘(B) An assessment of whether the proce-
dures developed under section 3 of such Act 
comply with the goals described in subpara-
graphs (A), (B), and (C) of subsection (a)(1). 
‘‘(C) An assessment of whether cyber 
threat indicators have been properly classified 
and an accounting of the number of security 
clearances authorized by the Federal Govern-
ment for the purposes of this section and such 
Act. 
‘‘(D) A review of the type of cyber threat 
indicators shared with the Federal Government 
under this section and such Act, including the 
following: 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(i) The degree to which such infor-
mation may impact the privacy and civil 
liberties of specific persons. 
‘‘(ii) A quantitative and qualitative as-
sessment of the impact of the sharing of 
such cyber threat indicators with the Fed-
eral Government on privacy and civil lib-
erties of specific persons. 
‘‘(iii) The adequacy of any steps taken 
by the Federal Government to reduce such 
impact. 
‘‘(E) A review of actions taken by the Fed-
eral Government based on cyber threat indica-
tors shared with the Federal Government under 
this section or such Act, including the appro-
priateness of any subsequent use or dissemina-
tion of such cyber threat indicators by a Fed-
eral entity under this section or section 4 of 
such Act. 
‘‘(F) A description of any significant viola-
tions of the requirements of this section or such 
Act by the Federal Government— 
‘‘(i) an assessment of all reports of of-
ficers, employees, and agents of the Fed-
eral Government misusing information pro-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
vided to the Federal Government under the 
Protecting Cyber Networks Act or this sec-
tion, without regard to whether the misuse 
was knowing or wilful; and 
‘‘(ii) an assessment of all disciplinary 
actions taken against such officers, em-
ployees, and agents. 
‘‘(G) A summary of the number and type 
of non-Federal entities that received classified 
cyber threat indicators from the Federal Gov-
ernment under this section or such Act and an 
evaluation of the risks and benefits of sharing 
such cyber threat indicators. 
‘‘(H) An assessment of any personal infor-
mation of or information identifying a specific 
person not directly related to a cybersecurity 
threat that— 
‘‘(i) was shared by a non-Federal enti-
ty with the Federal Government under this 
Act in contravention of section 3(d)(2) of 
such Act; or 
‘‘(ii) was shared within the Federal 
Government under this Act in contraven-
tion of the guidelines required by section 
4(b) of such Act. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS