114TH CONGRESS 
1ST SESSION H. R. 1560 
AN ACT 
To improve cybersecurity in the United States through en-
hanced sharing of information about cybersecurity 
threats, to amend the Homeland Security Act of 2002 
to enhance multi-directional sharing of information re-
lated to cybersecurity risks and strengthen privacy and 
civil liberties protections, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. TABLE OF CONTENTS. 
The table of contents of this Act is as follows: 
Sec. 1. Table of Contents. 
TITLE I—PROTECTING CYBER NETWORKS ACT 
Sec. 101. Short title. 
Sec. 102. Sharing of cyber threat indicators and defensive measures by the 
Federal Government with non-Federal entities. 
Sec. 103. Authorizations for preventing, detecting, analyzing, and mitigating 
cybersecurity threats. 
Sec. 104. Sharing of cyber threat indicators and defensive measures with ap-
propriate Federal entities other than the Department of De-
fense or the National Security Agency. 
Sec. 105. Federal Government liability for violations of privacy or civil liberties. 
Sec. 106. Protection from liability. 
Sec. 107. Oversight of Government activities. 
Sec. 108. Report on cybersecurity threats. 
Sec. 109. Construction and preemption. 
Sec. 110. Definitions. 
Sec. 111. Comptroller General report on removal of personal identifying infor-
mation. 
Sec. 112. Sunset. 
TITLE II—NATIONAL CYBERSECURITY PROTECTION 
ADVANCEMENT ACT 
Sec. 201. Short title. 
Sec. 202. National Cybersecurity and Communications Integration Center. 
Sec. 203. Information sharing structure and processes. 
Sec. 204. Information sharing and analysis organizations. 
Sec. 205. Streamlining of Department of Homeland Security cybersecurity and 
infrastructure protection organization. 
Sec. 206. Cyber incident response plans. 
Sec. 207. Security and resiliency of public safety communications; Cybersecu-
rity awareness campaign. 
Sec. 208. Critical infrastructure protection research and development. 
Sec. 209. Report on reducing cybersecurity risks in DHS data centers. 
Sec. 210. Assessment. 
Sec. 211. Consultation. 
Sec. 212. Technical assistance. 
Sec. 213. Prohibition on new regulatory authority. 
Sec. 214. Sunset. 
Sec. 215. Prohibition on new funding. 
Sec. 216. Protection of Federal information systems. 
Sec. 217. Sunset. 
Sec. 218. Report on cybersecurity vulnerabilities of United States ports. 
Sec. 219. Report on cybersecurity and critical infrastructure. 
Sec. 220. GAO report on impact privacy and civil liberties.
TITLE I—PROTECTING CYBER 
NETWORKS ACT 
SEC. 101. SHORT TITLE. 
This title may be cited as the ‘‘Protecting Cyber Net-
works Act’’. 
SEC. 102. SHARING OF CYBER THREAT INDICATORS AND 
DEFENSIVE MEASURES BY THE FEDERAL 
GOVERNMENT WITH NON-FEDERAL ENTITIES. 
(a) IN GENERAL.—Title I of the National Security 
Act of 1947 (50 U.S.C. 3021 et seq.) is amended by in-
serting after section 110 (50 U.S.C. 3045) the following 
new section: 
‘‘SEC. 111. SHARING OF CYBER THREAT INDICATORS AND 
DEFENSIVE MEASURES BY THE FEDERAL 
GOVERNMENT WITH NON-FEDERAL ENTITIES. 
‘‘(a) SHARING BY THE FEDERAL GOVERNMENT.— 
‘‘(1) IN GENERAL.—Consistent with the protec-
tion of classified information, intelligence sources 
and methods, and privacy and civil liberties, the Di-
rector of National Intelligence, in consultation with 
the heads of the other appropriate Federal entities, 
shall develop and promulgate procedures to facilitate 
and promote— 
‘‘(A) the timely sharing of classified cyber 
threat indicators in the possession of the Fed-
eral Government with representatives of rel-
evant non-Federal entities with appropriate se-
curity clearances; 
‘‘(B) the timely sharing with relevant non- 
Federal entities of cyber threat indicators in the 
possession of the Federal Government that may 
be declassified and shared at an unclassified 
level; and 
‘‘(C) the sharing with non-Federal entities, 
if appropriate, of information in the possession 
of the Federal Government about imminent or 
ongoing cybersecurity threats to such entities to 
prevent or mitigate adverse impacts from such 
cybersecurity threats. 
‘‘(2) DEVELOPMENT
OF
PROCEDURES.—The 
procedures developed and promulgated under para-
graph (1) shall— 
‘‘(A) ensure the Federal Government has 
and maintains the capability to share cyber 
threat indicators in real time consistent with 
the protection of classified information; 
‘‘(B) incorporate, to the greatest extent 
practicable, existing processes and existing roles 
and responsibilities of Federal and non-Federal 
entities for information sharing by the Federal
Government, including sector-specific informa-
tion sharing and analysis centers; 
‘‘(C) include procedures for notifying non- 
Federal entities that have received a cyber 
threat indicator from a Federal entity under 
this Act that is known or determined to be in 
error or in contravention of the requirements of 
this section, the Protecting Cyber Networks 
Act, or the amendments made by such Act or 
another provision of Federal law or policy of 
such error or contravention; 
‘‘(D) include requirements for Federal en-
tities receiving a cyber threat indicator or de-
fensive measure to implement appropriate secu-
rity controls to protect against unauthorized ac-
cess to, or acquisition of, such cyber threat in-
dicator or defensive measure; 
‘‘(E) include procedures that require Fed-
eral entities, prior to the sharing of a cyber 
threat indicator, to— 
‘‘(i) review such cyber threat indicator 
to assess whether such cyber threat indi-
cator, in contravention of the requirement 
under section 3(d)(2) of the Protecting 
Cyber Networks Act, contains any infor-
mation that such Federal entity knows at 
the time of sharing to be personal informa-
tion of or information identifying a specific 
person not directly related to a cybersecu-
rity threat and remove such information; 
or 
‘‘(ii) implement a technical capability 
configured to remove or exclude any per-
sonal information of or information identi-
fying a specific person not directly related 
to a cybersecurity threat; and 
‘‘(F) include procedures to promote the ef-
ficient granting of security clearances to appro-
priate representatives of non-Federal entities. 
‘‘(b) DEFINITIONS.—In this section, the terms ‘ap-
propriate Federal entities’, ‘cyber threat indicator’, ‘defen-
sive measure’, ‘Federal entity’, and ‘non-Federal entity’ 
have the meaning given such terms in section 11 of the 
Protecting Cyber Networks Act.’’. 
(b) SUBMITTAL TO CONGRESS.—Not later than 90 
days after the date of the enactment of this title, the Di-
rector of National Intelligence, in consultation with the 
heads of the other appropriate Federal entities, shall sub-
mit to Congress the procedures required by section 111(a)
of the National Security Act of 1947, as inserted by sub-
section (a) of this section. 
(c) TABLE OF CONTENTS AMENDMENT.—The table 
of contents in the first section of the National Security 
Act of 1947 is amended by inserting after the item relat-
ing to section 110 the following new item: 
‘‘Sec. 111. Sharing of cyber threat indicators and defensive measures by the 
Federal Government with non-Federal entities.’’. 
SEC. 103. AUTHORIZATIONS FOR PREVENTING, DETECTING, 
ANALYZING, AND MITIGATING CYBERSECU-
RITY THREATS. 
(a) AUTHORIZATION FOR PRIVATE-SECTOR DEFEN-
SIVE MONITORING.— 
(1) IN GENERAL.—Notwithstanding any other 
provision of law, a private entity may, for a cyberse-
curity purpose, monitor— 
(A) an information system of such private 
entity; 
(B) an information system of a non-Fed-
eral entity or a Federal entity, upon the written 
authorization of such non-Federal entity or 
such Federal entity; and 
(C) information that is stored on, proc-
essed by, or transiting an information system 
monitored by the private entity under this para-
graph.
(2) CONSTRUCTION.—Nothing in this sub-
section shall be construed to— 
(A) authorize the monitoring of an infor-
mation system, or the use of any information 
obtained through such monitoring, other than 
as provided in this title; 
(B) authorize the Federal Government to 
conduct surveillance of any person; or 
(C) limit otherwise lawful activity. 
(b) AUTHORIZATION FOR OPERATION OF DEFENSIVE 
MEASURES.— 
(1) IN GENERAL.—Except as provided in para-
graph (2) and notwithstanding any other provision 
of law, a private entity may, for a cybersecurity pur-
pose, operate a defensive measure that is operated 
on— 
(A) an information system of such private 
entity to protect the rights or property of the 
private entity; and 
(B) an information system of a non-Fed-
eral entity or a Federal entity upon written au-
thorization of such non-Federal entity or such 
Federal entity for operation of such defensive 
measure to protect the rights or property of
such private entity, such non-Federal entity, or 
such Federal entity. 
(2) LIMITATION.—The authority provided in 
paragraph (1) does not include a defensive measure 
that destroys, renders unusable or inaccessible (in 
whole or in part), or substantially harms an infor-
mation system or information stored on, processed 
by, or transiting such information system not owned 
by— 
(A) the private entity operating such de-
fensive measure; or 
(B) a non-Federal entity or a Federal enti-
ty that has provided written authorization to 
that private entity for operation of such defen-
sive measure on the information system or in-
formation of the entity in accordance with this 
subsection. 
(3) CONSTRUCTION.—Nothing in this sub-
section shall be construed— 
(A) to authorize the use of a defensive 
measure other than as provided in this sub-
section; or 
(B) to limit otherwise lawful activity.
(c) AUTHORIZATION FOR SHARING OR RECEIVING 
CYBER
THREAT
INDICATORS
OR
DEFENSIVE
MEAS-
URES.— 
(1) IN GENERAL.—Except as provided in para-
graph (2) and notwithstanding any other provision 
of law, a non-Federal entity may, for a cybersecurity 
purpose and consistent with the requirement under 
subsection (d)(2) to remove personal information of 
or information identifying a specific person not di-
rectly related to a cybersecurity threat and the pro-
tection of classified information— 
(A) share a lawfully obtained cyber threat 
indicator or defensive measure with any other 
non-Federal entity or an appropriate Federal 
entity (other than the Department of Defense 
or any component of the Department, including 
the National Security Agency); and 
(B) receive a cyber threat indicator or de-
fensive measure from any other non-Federal en-
tity or an appropriate Federal entity. 
(2) LAWFUL RESTRICTION.—A non-Federal en-
tity receiving a cyber threat indicator or defensive 
measure from another non-Federal entity or a Fed-
eral entity shall comply with otherwise lawful restric-
tions placed on the sharing or use of such cyber
threat indicator or defensive measure by the sharing 
non-Federal entity or Federal entity. 
(3) CONSTRUCTION.—Nothing in this sub-
section shall be construed to— 
(A) authorize the sharing or receiving of a 
cyber threat indicator or defensive measure 
other than as provided in this subsection; 
(B) authorize the sharing or receiving of 
classified information by or with any person not 
authorized to access such classified information; 
(C) prohibit any Federal entity from en-
gaging in formal or informal technical discus-
sion regarding cyber threat indicators or defen-
sive measures with a non-Federal entity or from 
providing 
technical 
assistance 
to 
address 
vulnerabilities or mitigate threats at the request 
of such an entity; 
(D) limit otherwise lawful activity; 
(E) prohibit otherwise lawful sharing by a 
non-Federal entity of a cyber threat indicator 
or defensive measure with the Department of 
Defense or any component of the Department, 
including the National Security Agency; or 
(F) authorize the Federal Government to 
conduct surveillance of any person.
(d) PROTECTION AND USE OF INFORMATION.— 
(1) SECURITY OF INFORMATION.—A non-Fed-
eral entity monitoring an information system, oper-
ating a defensive measure, or providing or receiving 
a cyber threat indicator or defensive measure under 
this section shall implement an appropriate security 
control to protect against unauthorized access to, or 
acquisition of, such cyber threat indicator or defen-
sive measure. 
(2) REMOVAL OF CERTAIN PERSONAL INFORMA-
TION.—A non-Federal entity sharing a cyber threat 
indicator pursuant to this title shall, prior to such 
sharing, take reasonable efforts to— 
(A) review such cyber threat indicator to 
assess whether such cyber threat indicator con-
tains any information that the non-Federal en-
tity reasonably believes at the time of sharing 
to be personal information of or information 
identifying a specific person not directly related 
to a cybersecurity threat and remove such infor-
mation; or 
(B) implement a technical capability con-
figured to remove any information contained 
within such indicator that the non-Federal enti-
ty reasonably believes at the time of sharing to
be personal information of or information iden-
tifying a specific person not directly related to 
a cybersecurity threat. 
(3) USE OF CYBER THREAT INDICATORS AND 
DEFENSIVE
MEASURES
BY
NON-FEDERAL
ENTI-
TIES.—A non-Federal entity may, for a cybersecu-
rity purpose— 
(A) use a cyber threat indicator or defen-
sive measure shared or received under this sec-
tion to monitor or operate a defensive measure 
on— 
(i) an information system of such non- 
Federal entity; or 
(ii) an information system of another 
non-Federal entity or a Federal entity 
upon the written authorization of that 
other non-Federal entity or that Federal 
entity; and 
(B) otherwise use, retain, and further 
share such cyber threat indicator or defensive 
measure subject to— 
(i) an otherwise lawful restriction 
placed by the sharing non-Federal entity 
or Federal entity on such cyber threat in-
dicator or defensive measure; or
(ii) an otherwise applicable provision 
of law. 
(4) USE
OF
CYBER
THREAT
INDICATORS
BY 
STATE, TRIBAL, OR LOCAL GOVERNMENT.— 
(A) LAW
ENFORCEMENT
USE.—A State, 
tribal, or local government may use a cyber 
threat indicator shared with such State, tribal, 
or local government for the purposes described 
in clauses (i), (ii), and (iii) of section 
104(d)(5)(A). 
(B) EXEMPTION
FROM
DISCLOSURE.—A 
cyber threat indicator or defensive measure 
shared with a State, tribal, or local government 
under this section shall be— 
(i) deemed voluntarily shared informa-
tion; and 
(ii) exempt from disclosure under any 
State, tribal, or local law requiring disclo-
sure of information or records, except as 
otherwise required by applicable State, 
tribal, or local law requiring disclosure in 
any criminal prosecution. 
(e) NO RIGHT OR BENEFIT.—The sharing of a cyber 
threat indicator with a non-Federal entity under this title 
shall not create a right or benefit to similar information
by such non-Federal entity or any other non-Federal enti-
ty. 
(f) SMALL BUSINESS PARTICIPATION.— 
(1) ASSISTANCE.—The Administrator of the 
Small Business Administration shall provide assist-
ance to small businesses and small financial institu-
tions to monitor information and information sys-
tems, operate defensive measures, and share and re-
ceive cyber threat indicators and defensive measures 
under this section. 
(2) REPORT.—Not later than 1 year after the 
date of the enactment of this title, the Administrator 
of the Small Business Administration shall submit 
to the President a report on the degree to which 
small businesses and small financial institutions are 
able to engage in cyber threat information sharing 
under this section. Such report shall include the rec-
ommendations of the Administrator for improving 
the ability of such businesses and institutions to en-
gage in cyber threat information sharing and to use 
shared information to defend their networks. 
(3) 
OUTREACH.—The 
Federal 
Government 
shall conduct outreach to small businesses and small 
financial institutions to encourage such businesses
and institutions to exercise their authority under 
this section. 
SEC. 104. SHARING OF CYBER THREAT INDICATORS AND 
DEFENSIVE MEASURES WITH APPROPRIATE 
FEDERAL ENTITIES OTHER THAN THE DE-
PARTMENT OF DEFENSE OR THE NATIONAL 
SECURITY AGENCY. 
(a) REQUIREMENT
FOR
POLICIES
AND
PROCE-
DURES.— 
(1) IN GENERAL.—Section 111 of the National 
Security Act of 1947, as inserted by section 102 of 
this title, is amended— 
(A) by redesignating subsection (b) as sub-
section (c); and 
(B) by inserting after subsection (a) the 
following new subsection: 
‘‘(b) POLICIES
AND PROCEDURES
FOR SHARING 
WITH
THE APPROPRIATE FEDERAL ENTITIES OTHER 
THAN
THE DEPARTMENT
OF DEFENSE
OR
THE NA-
TIONAL SECURITY AGENCY.— 
‘‘(1) ESTABLISHMENT.—The President shall 
develop and submit to Congress policies and proce-
dures relating to the receipt of cyber threat indica-
tors and defensive measures by the Federal Govern-
ment.
‘‘(2) REQUIREMENTS
CONCERNING
POLICIES 
AND PROCEDURES.—The policies and procedures re-
quired under paragraph (1) shall— 
‘‘(A) be developed in accordance with the 
privacy and civil liberties guidelines required 
under section 4(b) of the Protecting Cyber Net-
works Act; 
‘‘(B) ensure that— 
‘‘(i) a cyber threat indicator shared by 
a non-Federal entity with an appropriate 
Federal entity (other than the Department 
of Defense or any component of the De-
partment, including the National Security 
Agency) pursuant to section 3 of such Act 
is shared in real-time with all of the appro-
priate Federal entities (including all rel-
evant components thereof); 
‘‘(ii) the sharing of such cyber threat 
indicator with appropriate Federal entities 
is not subject to any delay, modification, or 
any other action without good cause that 
could impede receipt by all of the appro-
priate Federal entities; and 
‘‘(iii) such cyber threat indicator is 
provided to each other Federal entity to
which such cyber threat indicator is rel-
evant; and 
‘‘(C) ensure there— 
‘‘(i) is an audit capability; and 
‘‘(ii) are appropriate sanctions in 
place for officers, employees, or agents of 
a Federal entity who knowingly and will-
fully use a cyber threat indicator or de-
fense measure shared with the Federal 
Government by a non-Federal entity under 
the Protecting Cyber Networks Act other 
than in accordance with this section and 
such Act.’’. 
(2) SUBMISSION.—The President shall submit 
to Congress— 
(A) not later than 90 days after the date 
of the enactment of this title, interim policies 
and 
procedures 
required 
under 
section 
111(b)(1) of the National Security Act of 1947, 
as inserted by paragraph (1) of this section; 
and 
(B) not later than 180 days after such 
date, final policies and procedures required 
under such section 111(b)(1). 
(b) PRIVACY AND CIVIL LIBERTIES.—
(1) GUIDELINES OF ATTORNEY GENERAL.—The 
Attorney General, in consultation with the heads of 
the other appropriate Federal agencies and with offi-
cers designated under section 1062 of the Intel-
ligence Reform and Terrorism Prevention Act of 
2004 (42 U.S.C. 2000ee–1), shall develop and peri-
odically review guidelines relating to privacy and 
civil liberties that govern the receipt, retention, use, 
and dissemination of cyber threat indicators by a 
Federal entity obtained in accordance with this title 
and the amendments made by this title. 
(2) CONTENT.—The guidelines developed and 
reviewed under paragraph (1) shall, consistent with 
the need to protect information systems from cyber-
security threats and mitigate cybersecurity threats— 
(A) limit the impact on privacy and civil 
liberties of activities by the Federal Government 
under this title, including guidelines to ensure 
that personal information of or information 
identifying specific persons is properly removed 
from information received, retained, used, or 
disseminated by a Federal entity in accordance 
with this title or the amendments made by this 
title;
or determined by a Federal entity receiving 
such information not to constitute a cyber 
threat indicator; 
(E) be consistent with any other applicable 
provisions of law and the fair information prac-
tice principles set forth in appendix A of the 
document entitled ‘‘National Strategy for 
Trusted Identities in Cyberspace’’ and pub-
lished by the President in April, 2011; and 
(F) include steps that may be needed so 
that dissemination of cyber threat indicators is 
consistent with the protection of classified infor-
mation and other sensitive national security in-
formation. 
(3) SUBMISSION.—The Attorney General shall 
submit to Congress— 
(A) not later than 90 days after the date 
of the enactment of this title, interim guidelines 
required under paragraph (1); and 
(B) not later than 180 days after such 
date, final guidelines required under such para-
graph. 
(c) NATIONAL CYBER THREAT INTELLIGENCE INTE-
GRATION CENTER.—
(1) ESTABLISHMENT.—Title I of the National 
Security Act of 1947 (50 U.S.C. 3021 et seq.), as 
amended by section 102 of this title, is further 
amended— 
(A) by redesignating section 119B as sec-
tion 119C; and 
(B) by inserting after section 119A the fol-
lowing new section: 
‘‘SEC. 119B. CYBER THREAT INTELLIGENCE INTEGRATION 
CENTER. 
‘‘(a) ESTABLISHMENT.—There is within the Office of 
the Director of National Intelligence a Cyber Threat Intel-
ligence Integration Center. 
‘‘(b) DIRECTOR.—There is a Director of the Cyber 
Threat Intelligence Integration Center, who shall be the 
head of the Cyber Threat Intelligence Integration Center, 
and who shall be appointed by the Director of National 
Intelligence. 
‘‘(c) PRIMARY MISSIONS.—The Cyber Threat Intel-
ligence Integration Center shall— 
‘‘(1) serve as the primary organization within 
the Federal Government for analyzing and inte-
grating all intelligence possessed or acquired by the 
United States pertaining to cyber threats;
‘‘(2) ensure that appropriate departments and 
agencies have full access to and receive all-source in-
telligence support needed to execute the cyber threat 
intelligence activities of such agencies and to per-
form independent, alternative analyses; 
‘‘(3) disseminate cyber threat analysis to the 
President, the appropriate departments and agencies 
of the Federal Government, and the appropriate 
committees of Congress; 
‘‘(4) coordinate cyber threat intelligence activi-
ties of the departments and agencies of the Federal 
Government; and 
‘‘(5) conduct strategic cyber threat intelligence 
planning for the Federal Government. 
‘‘(d) LIMITATIONS.—The Cyber Threat Intelligence 
Integration Center shall— 
‘‘(1) have not more than 50 permanent posi-
tions; 
‘‘(2) in carrying out the primary missions of the 
Center described in subsection (c), may not augment 
staffing through detailees, assignees, or core con-
tractor personnel or enter into any personal services 
contracts to exceed the limitation under paragraph 
(1); and
‘‘(3) be located in a building owned or operated 
by an element of the intelligence community as of 
the date of the enactment of this section.’’. 
(2) TABLE OF CONTENTS AMENDMENTS.—The 
table of contents in the first section of the National 
Security Act of 1947, as amended by section 102 of 
this title, is further amended by striking the item re-
lating to section 119B and inserting the following 
new items: 
‘‘Sec. 119B. Cyber Threat Intelligence Integration Center. 
‘‘Sec. 119C. National intelligence centers.’’. 
(d) INFORMATION SHARED WITH OR PROVIDED TO 
THE FEDERAL GOVERNMENT.— 
(1) NO
WAIVER
OF
PRIVILEGE
OR
PROTEC-
TION.—The provision of a cyber threat indicator or 
defensive measure to the Federal Government under 
this title shall not constitute a waiver of any applica-
ble privilege or protection provided by law, including 
trade secret protection. 
(2) PROPRIETARY
INFORMATION.—Consistent 
with this title, a cyber threat indicator or defensive 
measure provided by a non-Federal entity to the 
Federal Government under this title shall be consid-
ered the commercial, financial, and proprietary in-
formation of the non-Federal entity that is the origi-
nator of such cyber threat indicator or defensive
measure when so designated by such non-Federal 
entity or a non-Federal entity acting in accordance 
with the written authorization of the non-Federal 
entity that is the originator of such cyber threat in-
dicator or defensive measure. 
(3) EXEMPTION FROM DISCLOSURE.—A cyber 
threat indicator or defensive measure provided to the 
Federal Government under this title shall be— 
(A) deemed voluntarily shared information 
and exempt from disclosure under section 552 
of title 5, United States Code, and any State, 
tribal, or local law requiring disclosure of infor-
mation or records; and 
(B) withheld, without discretion, from the 
public under section 552(b)(3) of title 5, United 
States Code, and any State, tribal, or local pro-
vision of law requiring disclosure of information 
or records, except as otherwise required by ap-
plicable Federal, State, tribal, or local law re-
quiring disclosure in any criminal prosecution. 
(4) EX PARTE COMMUNICATIONS.—The provi-
sion of a cyber threat indicator or defensive measure 
to the Federal Government under this title shall not 
be subject to a rule of any Federal department or
agency or any judicial doctrine regarding ex parte 
communications with a decision-making official. 
(5) DISCLOSURE, RETENTION, AND USE.— 
(A) AUTHORIZED
ACTIVITIES.—A cyber 
threat indicator or defensive measure provided 
to the Federal Government under this title may 
be disclosed to, retained by, and used by, con-
sistent with otherwise applicable provisions of 
Federal law, any department, agency, compo-
nent, officer, employee, or agent of the Federal 
Government solely for— 
(i) a cybersecurity purpose; 
(ii) the purpose of responding to, in-
vestigating, prosecuting, or otherwise pre-
venting or mitigating a threat of death or 
serious bodily harm or an offense arising 
out of such a threat; 
(iii) the purpose of responding to, in-
vestigating, prosecuting, or otherwise pre-
venting or mitigating, a serious threat to a 
minor, including sexual exploitation and 
threats to physical safety; or 
(iv) the purpose of preventing, inves-
tigating, disrupting, or prosecuting any of 
the offenses listed in sections 1028, 1029,