(1) IN GENERAL.—The Under Secretary for Intelligence and Anal-
ysis shall receive from the United States Secret Service homeland secu-
rity information, terrorism information, weapons of mass destruction 
information (as these terms are defined in section 11708 of this title), 
or national intelligence (as defined in section 3 of the National Security 
Act of 1947 (50 U.S.C. 3003)), as well as suspect information obtained 
in criminal investigations. The United States Secret Service shall co-
operate with the Under Secretary for Intelligence and Analysis with re-
spect to activities under this section and section 10506 of this title. 
(2) SAVINGS CLAUSE.—Nothing in the Implementing Recommenda-
tions of the 9/11 Commission Act of 2007 (Public Law 110–53, 121 
Stat. 266) shall interfere with the operation of section 3056(g) of title 
18, or with the authority of the Secretary or the Director of the United 
States Secret Service regarding the budget of the United States Secret 
Service. 
§ 10506. Comprehensive information technology network ar-
chitecture 
(a) DEFINITION OF COMPREHENSIVE INFORMATION TECHNOLOGY NET-
WORK ARCHITECTURE.—The term ‘‘comprehensive information technology 
network architecture’’ means an integrated framework for evolving or main-
taining existing information technology and acquiring new information tech-
nology to achieve the strategic management and information resources man-
agement goals of the Office of Intelligence and Analysis. 
(b) ESTABLISHMENT.—The Secretary, acting through the Under Sec-
retary for Intelligence and Analysis, shall establish, consistent with the poli-
cies and procedures developed under section 11708 of this title, and con-
sistent with the enterprise architecture of the Department, a comprehensive 
information technology network architecture for the Office of Intelligence 
and Analysis that connects the various databases and related information 
technology assets of the Office of Intelligence and Analysis and the intel-
ligence components of the Department in order to promote internal informa-
tion sharing among the intelligence and other personnel of the Department. 
§ 10507. Coordination with information sharing environ-
ment 
(a) GUIDANCE.—All activities to comply with sections 10504, 10505, and 
10506 of this title shall be— 
(1) consistent with policies, guidelines, procedures, instructions, or 
standards established under section 11708 of this title; 
(2) implemented in coordination with, as appropriate, the program 
manager for the information sharing environment established under 
that section; 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(3) consistent with applicable guidance issued by the Director of Na-
tional Intelligence; and 
(4) consistent with applicable guidance issued by the Secretary relat-
ing to the protection of law enforcement information or proprietary in-
formation. 
(b) CONSULTATION.—In carrying out the duties and responsibilities 
under this subchapter, the Under Secretary for Intelligence and Analysis 
shall take into account the views of the heads of the intelligence components 
of the Department. 
§ 10508. Intelligence components 
Subject to the direction and control of the Secretary, and consistent with 
applicable guidance issued by the Director of National Intelligence, the re-
sponsibilities of the head of each intelligence component of the Department 
are as follows: 
(1) To ensure that the collection, processing, analysis, and dissemi-
nation of information within the scope of the information sharing envi-
ronment, including homeland security information, terrorism informa-
tion, weapons of mass destruction information, and national intelligence 
(as defined in section 3 of the National Security Act of 1947 (50 
U.S.C. 3003)), are carried out effectively and efficiently in support of 
the intelligence mission of the Department, as led by the Under Sec-
retary for Intelligence and Analysis. 
(2) To otherwise support and implement the intelligence mission of 
the Department, as led by the Under Secretary for Intelligence and 
Analysis. 
(3) To incorporate the input of the Under Secretary for Intelligence 
and Analysis with respect to performance appraisals, bonus or award 
recommendations, pay adjustments, and other forms of commendation. 
(4) To coordinate with the Under Secretary for Intelligence and 
Analysis in developing policies and requirements for the recruitment 
and selection of intelligence officials of the intelligence component. 
(5) To advise and coordinate with the Under Secretary for Intel-
ligence and Analysis on any plan to reorganize or restructure the intel-
ligence component that would, if implemented, result in realignments 
of intelligence functions. 
(6) To ensure that employees of the intelligence component have 
knowledge of, and comply with, the programs and policies established 
by the Under Secretary for Intelligence and Analysis and other appro-
priate officials of the Department and that the employees comply with 
all applicable laws and regulations. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(7) To perform other activities relating to the responsibilities that 
the Secretary may provide. 
§ 10509. Training for employees of intelligence components 
The Secretary shall provide training and guidance for employees, officials, 
and senior executives of the intelligence components of the Department to 
develop knowledge of laws, regulations, operations, policies, procedures, and 
programs that are related to the functions of the Department relating to 
the collection, processing, analysis, and dissemination of information within 
the scope of the information sharing environment, including homeland secu-
rity information, terrorism information, and weapons of mass destruction 
information, or national intelligence (as the term is defined in section 3 of 
the National Security Act of 1947 (50 U.S.C. 3003)). 
§ 10510. Intelligence training development for State and 
local government officials 
(a) CURRICULUM.—The Secretary, acting through the Under Secretary 
for Intelligence and Analysis, shall— 
(1) develop a curriculum for training State, local, and tribal govern-
ment officials, including law enforcement officers, intelligence analysts, 
and other emergency response providers, in the intelligence cycle and 
Federal laws, practices, and regulations regarding the development, 
handling, and review of intelligence and other information; and 
(2) ensure that the curriculum includes executive level training for 
senior level State, local, and tribal law enforcement officers, intelligence 
analysts, and other emergency response providers. 
(b) TRAINING.—To the extent possible, the Federal Law Enforcement 
Training Center and other existing Federal entities with the capacity and 
expertise to train State, local, and tribal government officials based on the 
curriculum developed under subsection (a) shall be used to carry out the 
training programs created under this section. If the entities do not have the 
capacity, resources, or capabilities to conduct the training, the Secretary 
may approve another entity to conduct the training. 
(c) CONSULTATION.—In carrying out the duties described in subsection 
(a), the Under Secretary for Intelligence and Analysis shall consult with the 
Director of the Federal Law Enforcement Training Center, the Attorney 
General, the Director of National Intelligence, the Administrator of the Fed-
eral Emergency Management Agency, and other appropriate parties, such 
as private industry, institutions of higher education, nonprofit institutions, 
and other intelligence agencies of the Federal Government. 
§ 10511. Information sharing incentives 
(a) AWARDS.—In making cash awards under chapter 45 of title 5, the 
President or the head of an agency, in consultation with the program man-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
ager designated under section 11708 of this title, may consider the success 
of an employee in appropriately sharing information within the scope of the 
information sharing environment established under that section, including 
homeland security information, terrorism information, and weapons of mass 
destruction information, or national intelligence (as defined in section 3 of 
the National Security Act of 1947 (50 U.S.C. 3003)), in a manner con-
sistent with policies, guidelines, procedures, instructions, or standards estab-
lished by the President or, as appropriate, the program manager of that en-
vironment for the implementation and management of that environment. 
(b) OTHER INCENTIVES.—The head of each department or agency de-
scribed in section 11708(g), in consultation with the program manager des-
ignated under section 11708, shall adopt best practices regarding effective 
ways to educate and motivate officers and employees of the Federal Govern-
ment to participate fully in the information sharing environment, includ-
ing— 
(1) promotions and other nonmonetary awards; and 
(2) the publicizing of information sharing accomplishments by indi-
vidual employees and, where appropriate, the tangible end benefits that 
resulted. 
§ 10512. Department of Homeland Security State, Local, and 
Regional Fusion Center initiative 
(a) DEFINITIONS.—In this section: 
(1) FUSION CENTER.—The term ‘‘fusion center’’ means a collabo-
rative effort of two or more Federal, State, local, or tribal government 
agencies that combines resources, expertise, or information with the 
goal of maximizing the ability of the agencies to detect, prevent, inves-
tigate, apprehend, and respond to criminal or terrorist activity. 
(2) INFORMATION SHARING ENVIRONMENT.—The term ‘‘information 
sharing environment’’ means the information sharing environment es-
tablished under section 11708 of this title. 
(3) INTELLIGENCE
ANALYST.—The term ‘‘intelligence analyst’’ 
means an individual who regularly advises, administers, supervises, or 
performs work in the collection, gathering, analysis, evaluation, report-
ing, production, or dissemination of information on political, economic, 
social, cultural, physical, geographical, scientific, or military conditions, 
trends, or forces in foreign or domestic areas that directly or indirectly 
affect national security. 
(4) INTELLIGENCE-LED POLICING.—The term ‘‘intelligence-led polic-
ing’’ means the collection and analysis of information to produce an in-
telligence end product designed to inform law enforcement decision- 
making at the tactical and strategic levels. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(5) TERRORISM INFORMATION.—The term ‘‘terrorism information’’ 
has the meaning given the term in section 11708 of this title. 
(b) ESTABLISHMENT.—The Secretary, in consultation with the program 
manager of the information sharing environment established under section 
11708 of this title, the Attorney General, the Privacy Officer of the Depart-
ment, the Officer for Civil Rights and Civil Liberties of the Department, 
and the Privacy and Civil Liberties Oversight Board established under sec-
tion 1061 of the Intelligence Reform and Terrorism Prevention Act of 2004 
(42 U.S.C. 2000ee), shall establish a Department of Homeland Security 
State, Local, and Regional Fusion Center Initiative to establish partnerships 
with State, local, and regional fusion centers. 
(c) DEPARTMENT SUPPORT AND COORDINATION.—Through the Depart-
ment of Homeland Security State, Local, and Regional Fusion Center Ini-
tiative, and in coordination with the principal officials of participating State, 
local, or regional fusion centers and the officers designated as the Homeland 
Security Advisors of the States, the Secretary shall— 
(1) provide operational and intelligence advice and assistance to 
State, local, and regional fusion centers; 
(2) support efforts to include State, local, and regional fusion centers 
into efforts to establish an information sharing environment; 
(3) conduct tabletop and live training exercises to regularly assess 
the capability of individual and regional networks of State, local, and 
regional fusion centers to integrate the efforts of the networks with the 
efforts of the Department; 
(4) coordinate with other relevant Federal entities engaged in home-
land security-related activities; 
(5) provide analytic and reporting advice and assistance to State, 
local, and regional fusion centers; 
(6) review information within the scope of the information sharing 
environment, including homeland security information, terrorism infor-
mation, and weapons of mass destruction information, that is gathered 
by State, local, and regional fusion centers, and to incorporate the in-
formation, as appropriate, into the Department’s own information; 
(7) provide management assistance to State, local, and regional fu-
sion centers; 
(8) serve as a point of contact to ensure the dissemination of infor-
mation within the scope of the information sharing environment, in-
cluding homeland security information, terrorism information, and 
weapons of mass destruction information; 
(9) facilitate close communication and coordination between State, 
local, and regional fusion centers and the Department; 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(10) provide State, local, and regional fusion centers with expertise 
on Department resources and operations; 
(11) provide training to State, local, and regional fusion centers and 
encourage the fusion centers to participate in terrorism threat-related 
exercises conducted by the Department; and 
(12) carry out other duties the Secretary determines are appropriate. 
(d) PERSONNEL ASSIGNMENT.— 
(1) IN GENERAL.—The Under Secretary for Intelligence and Anal-
ysis shall, to the maximum extent practicable, assign officers and intel-
ligence analysts from components of the Department to participating 
State, local, and regional fusion centers. 
(2) PERSONNEL SOURCES.—Officers and intelligence analysts as-
signed to participating fusion centers under this subsection may be as-
signed from the following Department components, in coordination with 
the respective component head and in consultation with the principal 
officials of participating fusion centers: 
(A) Office of Intelligence and Analysis. 
(B) Office of Infrastructure Protection. 
(C) Transportation Security Administration. 
(D) U.S. Customs and Border Protection. 
(E) U.S. Immigration and Customs Enforcement. 
(F) Coast Guard. 
(G) Other components of the Department, as determined by the 
Secretary. 
(3) QUALIFYING CRITERIA.— 
(A) IN GENERAL.—The Secretary shall develop qualifying cri-
teria for a fusion center to participate in the assigning of Depart-
ment officers or intelligence analysts under this section. 
(B) CRITERIA.—Criteria developed under subparagraph (A) 
may include— 
(i) whether the fusion center, through its mission and gov-
ernance structure, focuses on a broad counterterrorism ap-
proach, and whether that broad approach is pervasive 
through all levels of the organization; 
(ii) whether the fusion center has sufficient numbers of 
adequately trained personnel to support a broad counterter-
rorism mission; 
(iii) whether the fusion center has— 
(I) access to relevant law enforcement, emergency re-
sponse, private sector, open source, and national security 
data; and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(II) the ability to share and analytically utilize that 
data for lawful purposes; 
(iv) whether the fusion center is adequately funded by the 
State, local, or regional government to support its counterter-
rorism mission; and 
(v) the relevancy of the mission of the fusion center to the 
particular source component of Department officers or intel-
ligence analysts. 
(4) PREREQUISITE.— 
(A) INTELLIGENCE ANALYSIS, PRIVACY, AND CIVIL LIBERTIES 
TRAINING.—Before being assigned to a fusion center under this 
section, an officer or intelligence analyst shall undergo— 
(i) appropriate intelligence analysis or information sharing 
training using an intelligence-led policing curriculum that is 
consistent with— 
(I) standard training and education programs offered 
to Department law enforcement and intelligence per-
sonnel; and 
(II) the Criminal Intelligence Systems Operating Poli-
cies under part 23 of title 28, Code of Federal Regula-
tions (or a corresponding similar rule or regulation); 
(ii) appropriate privacy and civil liberties training that is 
developed, supported, or sponsored by the Privacy Officer ap-
pointed under section 10543 of this title and the Officer for 
Civil Rights and Civil Liberties of the Department, in con-
sultation with the Privacy and Civil Liberties Oversight 
Board established under section 1061 of the Intelligence Re-
form and Terrorism Prevention Act of 2004 (42 U.S.C. 
2000ee); and 
(iii) other training prescribed by the Under Secretary for 
Intelligence and Analysis. 
(B) PRIOR WORK EXPERIENCE IN AREA.—In determining the 
eligibility of an officer or intelligence analyst to be assigned to a 
fusion center under this section, the Under Secretary for Intel-
ligence and Analysis shall consider the familiarity of the officer or 
intelligence analyst with the State, locality, or region, as deter-
mined by such factors as whether the officer or intelligence ana-
lyst— 
(i) has been previously assigned in the geographic area; or 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(ii) has previously worked with intelligence officials or law 
enforcement or other emergency response providers from that 
State, locality, or region. 
(5) EXPEDITED
SECURITY
CLEARANCE
PROCESSING.—The Under 
Secretary for Intelligence and Analysis— 
(A) shall ensure that each officer or intelligence analyst as-
signed to a fusion center under this section has the appropriate 
security clearance to contribute effectively to the mission of the fu-
sion center; and 
(B) may request that security clearance processing be expedited 
for each officer or intelligence analyst and may use available funds 
for this purpose. 
(6) ADDITIONAL QUALIFICATIONS.—Each officer or intelligence ana-
lyst assigned to a fusion center under this section shall satisfy any 
other qualifications the Under Secretary for Intelligence and Analysis 
may prescribe. 
(e) RESPONSIBILITIES.—An officer or intelligence analyst assigned to a 
fusion center under this section shall— 
(1) assist law enforcement agencies and other emergency response 
providers of State, local, and tribal governments and fusion center per-
sonnel in using information within the scope of the information sharing 
environment, including homeland security information, terrorism infor-
mation, and weapons of mass destruction information, to develop a 
comprehensive and accurate threat picture; 
(2) review homeland security-relevant information from law enforce-
ment agencies and other emergency response providers of State, local, 
and tribal government; 
(3) create intelligence and other information products derived from 
the information and other homeland security-relevant information pro-
vided by the Department; and 
(4) assist in the dissemination of the products, as coordinated by the 
Under Secretary for Intelligence and Analysis, to law enforcement 
agencies and other emergency response providers of State, local, and 
tribal government, other fusion centers, and appropriate Federal agen-
cies. 
(f) BORDER INTELLIGENCE PRIORITY.— 
(1) IN GENERAL.—The Secretary shall make it a priority to assign 
officers and intelligence analysts under this section from U.S. Customs 
and Border Protection, U.S. Immigration and Customs Enforcement, 
and the Coast Guard to participating State, local, and regional fusion 
centers located in jurisdictions along land or maritime borders of the 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
United States in order to enhance the integrity of and security at the 
borders by helping Federal, State, local, and tribal law enforcement au-
thorities to identify, investigate, and otherwise interdict persons, weap-
ons, and related contraband that pose a threat to homeland security. 
(2) BORDER INTELLIGENCE PRODUCTS.—When performing the re-
sponsibilities described in subsection (e), officers and intelligence ana-
lysts assigned to participating State, local, and regional fusion centers 
under this section shall have, as a primary responsibility, the creation 
of border intelligence products that— 
(A) assist State, local, and tribal law enforcement agencies in 
deploying their resources most efficiently to help detect and inter-
dict terrorists, weapons of mass destruction, and related contra-
band at land or maritime borders of the United States; 
(B) promote more consistent and timely sharing of border secu-
rity-relevant information among jurisdictions along land or mari-
time borders of the United States; and 
(C) enhance the Department’s situational awareness of the 
threat of acts of terrorism at or involving the land or maritime 
borders of the United States. 
(g) DATABASE ACCESS.—To fulfill the objectives described under sub-
section (e), each officer or intelligence analyst assigned to a fusion center 
under this section shall have appropriate access to all relevant Federal data-
bases and information systems, consistent with policies, guidelines, proce-
dures, instructions, or standards established by the President or, as appro-
priate, the program manager of the information sharing environment for the 
implementation and management of that environment. 
(h) CONSUMER FEEDBACK.— 
(1) IN GENERAL.—The Secretary shall create a voluntary mechanism 
for a State, local, or tribal law enforcement officer or other emergency 
response provider who is a consumer of the intelligence or other infor-
mation products referred to in subsection (e) to provide feedback to the 
Department on the quality and utility of the intelligence products. 
(2) REPORT.—The Secretary shall submit annually to the Committee 
on Homeland Security and Governmental Affairs of the Senate and the 
Committee on Homeland Security of the House of Representatives a 
report that includes a description of the consumer feedback obtained 
under paragraph (1) and, if applicable, how the Department has ad-
justed its production of intelligence products in response to that con-
sumer feedback. 
(i) RULE OF CONSTRUCTION.— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(1) IN GENERAL.—The authorities granted under this section shall 
supplement the authorities granted under section 10501(b) of this title, 
and nothing in this section shall be construed to abrogate the authori-
ties granted under section 10501(b). 
(2) PARTICIPATION.—Nothing in this section shall be construed to 
require a State, local, or regional government or entity to accept the 
assignment of officers or intelligence analysts of the Department into 
the fusion center of that State, locality, or region. 
(j) GUIDELINES.—The Secretary, in consultation with the Attorney Gen-
eral, shall establish guidelines for fusion centers created and operated by 
State and local governments, to include standards that a fusion center 
shall— 
(1) collaboratively develop a mission statement, identify expectations 
and goals, measure performance, and determine effectiveness for that 
fusion center; 
(2) create a representative governance structure that includes law 
enforcement officers and other emergency response providers and, as 
appropriate, the private sector; 
(3) create a collaborative environment for the sharing of intelligence 
and information among Federal, State, local, and tribal government 
agencies (including law enforcement officers and other emergency re-
sponse providers), the private sector, and the public, consistent with 
policies, guidelines, procedures, instructions, or standards established 
by the President or, as appropriate, the program manager of the infor-
mation sharing environment; 
(4) leverage the databases, systems, and networks available from 
public- and private-sector entities, in accordance with all applicable 
laws, to maximize information sharing; 
(5) develop, publish, and adhere to a privacy and civil liberties policy 
consistent with Federal, State, and local law; 
(6) provide, in coordination with the Privacy Officer of the Depart-
ment and the Officer for Civil Rights and Civil Liberties of the Depart-
ment, appropriate privacy and civil liberties training for all State, local, 
tribal, and private-sector representatives at the fusion center; 
(7) ensure appropriate security measures are in place for the facility, 
data, and personnel; 
(8) select and train personnel based on the needs, mission, goals, and 
functions of that fusion center; 
(9) offer a variety of intelligence and information services and prod-
ucts to recipients of fusion center intelligence and information; and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(10) incorporate law enforcement officers, other emergency response 
providers, and, as appropriate, the private sector, into all relevant 
phases of the intelligence and fusion process, consistent with the mis-
sion statement developed under paragraph (1), either through full time 
representatives or liaison relationships with the fusion center to enable 
the receipt and sharing of information and intelligence. 
§ 10513. Homeland Security Information Sharing Fellows 
Program 
(a) ESTABLISHMENT.—The Secretary, acting through the Under Sec-
retary for Intelligence and Analysis, and in consultation with the Chief 
Human Capital Officer, shall establish the Homeland Security Information 
Sharing Fellows Program for the purpose of— 
(1) detailing State, local, and tribal law enforcement officers and in-
telligence analysts to the Department in accordance with subchapter VI 
of chapter 33 of title 5, to participate in the work of the Office of Intel-
ligence and Analysis in order to become familiar with— 
(A) the relevant missions and capabilities of the Department 
and other Federal agencies; and 
(B) the role, programs, products, and personnel of the Office of 
Intelligence and Analysis; and 
(2) promoting information sharing between the Department and 
State, local, and tribal law enforcement officers and intelligence ana-
lysts by assigning the officers and analysts to— 
(A) serve as a point of contact in the Department to assist in 
the representation of State, local, and tribal information require-
ments; 
(B) identify information within the scope of the information 
sharing environment, including homeland security information, ter-
rorism information, and weapons of mass destruction information, 
that is of interest to State, local, and tribal law enforcement offi-
cers, intelligence analysts, and other emergency response pro-
viders; 
(C) assist Department analysts in preparing and disseminating 
products derived from information within the scope of the informa-
tion sharing environment, including homeland security informa-
tion, terrorism information, and weapons of mass destruction in-
formation, that are tailored to State, local, and tribal law enforce-
ment officers and intelligence analysts and designed to prepare for 
and thwart acts of terrorism; and 
(D) assist Department analysts in preparing products derived 
from information within the scope of the information sharing envi-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
ronment, including homeland security information, terrorism infor-
mation, and weapons of mass destruction information, that are 
tailored to State, local, and tribal emergency response providers 
and assist in the dissemination of the products through appro-
priate Department channels. 
(b) ELIGIBILITY.—To be eligible for selection as an Information Sharing 
Fellow under the program under the Homeland Security Information Shar-
ing Fellows Program, an individual shall— 
(1) have homeland security-related responsibilities; 
(2) be eligible for an appropriate security clearance; 
(3) possess a valid need for access to classified information, as deter-
mined by the Under Secretary for Intelligence and Analysis; 
(4) be an employee of— 
(A) a State, local, or regional fusion center; 
(B) a State or local law enforcement or other government entity 
that serves a major metropolitan area, suburban area, or rural 
area, as determined by the Secretary; 
(C) a State or local law enforcement or other government entity 
with port, border, or agricultural responsibilities, as determined by 
the Secretary; 
(D) a tribal law enforcement or other authority; or 
(E) another entity the Secretary determines is appropriate; and 
(5) have undergone appropriate privacy and civil liberties training 
that is developed, supported, or sponsored by the Privacy Officer and 
the Officer for Civil Rights and Civil Liberties, in consultation with the 
Privacy and Civil Liberties Oversight Board established under section 
1061 of the Intelligence Reform and Terrorism Prevention Act of 2004 
(42 U.S.C. 2000ee). 
(c) OPTIONAL PARTICIPATION.—A State, local, or tribal law enforcement 
or other government entity shall not be required to participate in the Home-
land Security Information Sharing Fellows Program. 
(d) PROCEDURES FOR NOMINATION AND SELECTION.— 
(1) IN GENERAL.—The Under Secretary for Intelligence and Anal-
ysis shall establish procedures to provide for the nomination and selec-
tion of individuals to participate in the Homeland Security Information 
Sharing Fellows Program. 
(2) LIMITATIONS.—The Under Secretary for Intelligence and Anal-
ysis shall— 
(A) select law enforcement officers and intelligence analysts rep-
resenting a broad cross-section of State, local, and tribal agencies; 
and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(B) ensure that the number of Information Sharing Fellows se-
lected does not impede the activities of the Office of Intelligence 
and Analysis. 
§ 10514. Rural Policing Institute 
(a) DEFINITION OF RURAL.—In this section, the term ‘‘rural’’ means an 
area— 
(1) that is not located in a metropolitan statistical area, as defined 
by the Office of Management and Budget; or 
(2) that is located in a metropolitan statistical area and a county, 
borough, parish, or area under the jurisdiction of an Indian tribe with 
a population of not more than 50,000. 
(b) IN GENERAL.—The Secretary shall establish a Rural Policing Insti-
tute, which shall be administered by the Federal Law Enforcement Training 
Center, to target training to law enforcement agencies and other emergency 
response providers located in rural areas. The Secretary, through the Rural 
Policing Institute, shall— 
(1) evaluate the needs of law enforcement agencies and other emer-
gency response providers in rural areas; 
(2) develop expert training programs designed to address the needs 
of law enforcement agencies and other emergency response providers in 
rural areas as identified in the evaluation conducted under paragraph 
(1), including training programs about intelligence-led policing and pro-
tections for privacy, civil rights, and civil liberties; 
(3) provide the training programs developed under paragraph (2) to 
law enforcement agencies and other emergency response providers in 
rural areas; and 
(4) conduct outreach efforts to ensure that local and tribal govern-
ments in rural areas are aware of the training programs developed 
under paragraph (2) so they can avail themselves of the programs. 
(c) CURRICULA.—The training at the Rural Policing Institute established 
under subsection (a) shall— 
(1) be configured in a manner so as not to duplicate or displace a 
law enforcement or emergency response program of the Federal Law 
Enforcement Training Center or a local or tribal government entity in 
existence on August 3, 2007; and 
(2) to the maximum extent practicable, be delivered in a cost-effec-
tive manner at facilities of the Department, on closed military installa-
tions with adequate training facilities, or at facilities operated by the 
participants. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
§ 10515. Interagency Threat Assessment and Coordination 
Group 
(a) IN GENERAL.—To improve the sharing of information within the 
scope of the information sharing environment established under section 
11708 of this title with State, local, tribal, and private-sector officials, the 
Director of National Intelligence, through the program manager for the in-
formation sharing environment, in coordination with the Secretary, shall co-
ordinate and oversee the creation of an Interagency Threat Assessment and 
Coordination Group (in this section referred to as ‘‘ITACG’’). 
(b) COMPOSITION OF ITACG.—The ITACG shall consist of— 
(1) an ITACG Advisory Council to set policy and develop processes 
for the integration, analysis, and dissemination of federally coordinated 
information within the scope of the information sharing environment, 
including homeland security information, terrorism information, and 
weapons of mass destruction information; and 
(2) an ITACG Detail comprised of State, local, and tribal homeland 
security and law enforcement officers and intelligence analysts detailed 
to work in the National Counterterrorism Center with Federal intel-
ligence analysts for the purpose of integrating, analyzing, and assisting 
in the dissemination of federally coordinated information within the 
scope of the information sharing environment, including homeland se-
curity information, terrorism information, and weapons of mass de-
struction information, through appropriate channels identified by the 
ITACG Advisory Council. 
(c) RESPONSIBILITIES OF PROGRAM MANAGER.—The program manager 
shall— 
(1) monitor and assess the efficacy of the ITACG; 
(2) submit annually to the Secretary, the Attorney General, the Di-
rector of National Intelligence, the Committee on Homeland Security 
and Governmental Affairs of the Senate, and the Committee on Home-
land Security of the House of Representatives a report on the progress 
of the ITACG; and 
(3) in each report required by paragraph (2), include an assessment 
of whether the detailees under subsection (d)(5) have appropriate ac-
cess to all relevant information, as required by subsection (g)(2)(C). 
(d) RESPONSIBILITIES
OF SECRETARY.—The Secretary, or the Sec-
retary’s designee, in coordination with the Director of the National Counter-
terrorism Center and the ITACG Advisory Council, shall— 
(1) create policies and standards for the creation of information 
products derived from information within the scope of the information 
sharing environment, including homeland security information, ter-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
rorism information, and weapons of mass destruction information, that 
are suitable for dissemination to State, local, and tribal governments 
and the private sector; 
(2) evaluate and develop processes for the timely dissemination of 
federally coordinated information within the scope of the information 
sharing environment, including homeland security information, ter-
rorism information, and weapons of mass destruction information, to 
State, local, and tribal governments and the private sector; 
(3) establish criteria and a methodology for indicating to State, local, 
and tribal governments and the private sector the reliability of informa-
tion within the scope of the information sharing environment, including 
homeland security information, terrorism information, and weapons of 
mass destruction information, disseminated to them; 
(4) educate the intelligence community about the requirements of the 
State, local, and tribal homeland security, law enforcement, and other 
emergency response providers regarding information within the scope 
of the information sharing environment, including homeland security 
information, terrorism information, and weapons of mass destruction 
information; 
(5) establish and maintain the ITACG Detail, which shall assign an 
appropriate number of State, local, and tribal homeland security and 
law enforcement officers and intelligence analysts to work in the Na-
tional Counterterrorism Center who shall— 
(A) educate and advise National Counterterrorism Center intel-
ligence analysts about the requirements of the State, local, and 
tribal homeland security and law enforcement officers, and other 
emergency response providers regarding information within the 
scope of the information sharing environment, including homeland 
security information, terrorism information, and weapons of mass 
destruction information; 
(B) assist National Counterterrorism Center intelligence ana-
lysts in integrating, analyzing, and otherwise preparing versions of 
products derived from information within the scope of the informa-
tion sharing environment, including homeland security informa-
tion, terrorism information, and weapons of mass destruction in-
formation that are unclassified or classified at the lowest possible 
level and suitable for dissemination to State, local, and tribal 
homeland security and law enforcement agencies in order to help 
deter and prevent terrorist attacks; 
(C) implement, in coordination with National Counterterrorism 
Center intelligence analysts, the policies, processes, procedures, 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
standards, and guidelines developed by the ITACG Advisory Coun-
cil; 
(D) assist in the dissemination of products derived from infor-
mation within the scope of the information sharing environment, 
including homeland security information, terrorism information, 
and weapons of mass destruction information, to State, local, and 
tribal jurisdictions only through appropriate channels identified by 
the ITACG Advisory Council; 
(E) make recommendations, as appropriate, to the Secretary or 
the Secretary’s designee, for the further dissemination of intel-
ligence products that could likely inform or improve the security 
of a State, local, or tribal government (including a State, local, or 
tribal law enforcement agency), or a private-sector entity; and 
(F) report directly to the senior intelligence official from the 
Department under paragraph (6); 
(6) detail a senior intelligence official from the Department to the 
National Counterterrorism Center, who shall— 
(A) manage the day-to-day operations of the ITACG Detail; 
(B) report directly to the Director of the National Counterter-
rorism Center or the Director’s designee; and 
(C) in coordination with the Director of the Federal Bureau of 
Investigation, and subject to the approval of the Director of the 
National Counterterrorism Center, select a deputy from the pool 
of available detailees from the Federal Bureau of Investigation in 
the National Counterterrorism Center; 
(7) establish, in the ITACG Advisory Council, a mechanism to select 
law enforcement officers and intelligence analysts for placement in the 
National Counterterrorism Center consistent with paragraph (5), using 
criteria developed by the ITACG Advisory Council that shall encourage 
participation from a broadly representative group of State, local, and 
tribal homeland security and law enforcement agencies; 
(8) compile an annual assessment of the ITACG Detail’s perform-
ance, including summaries of customer feedback, in preparing, dissemi-
nating, and requesting the dissemination of intelligence products in-
tended for State, local and tribal government (including State, local, 
and tribal law enforcement agencies), and private-sector entities; and 
(9) provide the assessment developed under paragraph (8) to the 
program manager for use in the annual reports required by subsection 
(c)(2). 
(e) MEMBERSHIP.—The Secretary, or the Secretary’s designee, shall serve 
as the chair of the ITACG Advisory Council, which shall include— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
(1) representatives of— 
(A) the Department; 
(B) the Federal Bureau of Investigation; 
(C) the National Counterterrorism Center; 
(D) the Department of Defense; 
(E) the Department of Energy; 
(F) the Department of State; and 
(G) other Federal entities as appropriate; 
(2) the program manager of the information sharing environment, 
designated under section 11708(d) of this title, or the program man-
ager’s designee; and 
(3) executive level law enforcement and intelligence officials from 
State, local, and tribal governments. 
(f) CRITERIA.—The Secretary, in consultation with the Director of Na-
tional Intelligence, the Attorney General, and the program manager of the 
information sharing environment established under section 11708 of this 
title, shall— 
(1) establish procedures for selecting members of the ITACG Advi-
sory Council and for the proper handling and safeguarding of products 
derived from information within the scope of the information sharing 
environment, including homeland security information, terrorism infor-
mation, and weapons of mass destruction information, by those mem-
bers; and 
(2) ensure that at least 50 percent of the members of the ITACG 
Advisory Council are from State, local, and tribal governments. 
(g) OPERATIONS.— 
(1) IN GENERAL.—The ITACG Advisory Council shall meet regu-
larly, but not less than quarterly, at the facilities of the National 
Counterterrorism Center of the Office of the Director of National Intel-
ligence. 
(2) MANAGEMENT.—Pursuant to section 119(f)(1)(E) of the Na-
tional Security Act of 1947 (50 U.S.C. 3056(f)(1)(E)), the Director of 
the National Counterterrorism Center, acting through the senior intel-
ligence official from the Department of Homeland Security detailed 
pursuant to subsection (d)(6), shall ensure that— 
(A) the products derived from information within the scope of 
the information sharing environment, including homeland security 
information, terrorism information, and weapons of mass destruc-
tion information, prepared by the National Counterterrorism Cen-
ter and the ITACG Detail for distribution to State, local, and trib-
al homeland security and law enforcement agencies, reflect the re-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
quirements of the agencies and are produced consistently with the 
policies, processes, procedures, standards, and guidelines estab-
lished by the ITACG Advisory Council; 
(B) in consultation with the ITACG Advisory Council and con-
sistent with sections 102A(f)(1)(B)(iii) and 119(f)(1)(E) of the 
National Security Act of 1947 (50 U.S.C. 3024(f)(1)(B)(iii), 
3056(f)(1)(E)), all products described in subparagraph (A) are 
disseminated through existing channels of the Department and the 
Department of Justice and other appropriate channels to State, 
local, and tribal government officials and other entities; 
(C) all detailees under subsection (d)(5) have appropriate access 
to all relevant information within the scope of the information 
sharing environment, including homeland security information, ter-
rorism information, and weapons of mass destruction information, 
available at the National Counterterrorism Center in order to ac-
complish the objectives under subsection (d)(5); 
(D) all detailees under subsection (d)(5) have the appropriate 
security clearances and are trained in the procedures for handling, 
processing, storing, and disseminating classified products derived 
from information within the scope of the information sharing envi-
ronment, including homeland security information, terrorism infor-
mation, and weapons of mass destruction information; and 
(E) all detailees under subsection (d)(5) complete appropriate 
privacy and civil liberties training. 
(h) INAPPLICABILITY OF THE FEDERAL ADVISORY COMMITTEE ACT.— 
The Federal Advisory Committee Act (5 U.S.C. App.) shall not apply to the 
ITACG or any subsidiary groups of the ITACG. 
§ 10516. National asset database 
(a) ESTABLISHMENT.— 
(1) NATIONAL ASSET DATABASE.—The Secretary shall establish and 
maintain a national database of each system or asset that— 
(A) the Secretary, in consultation with appropriate homeland se-
curity officials of the States, determines to be vital and the loss, 
interruption, incapacity, or destruction of which would have a neg-
ative or debilitating effect on the economic security, public health, 
or safety of the United States, a State, or a local government; or 
(B) the Secretary determines is appropriate for inclusion in the 
database. 
(2) PRIORITIZED CRITICAL INFRASTRUCTURE LIST.—In accordance 
with Homeland Security Presidential Directive–7, as in effect on Janu-
ary 1, 2007, the Secretary shall establish and maintain a single classi-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
fied prioritized list of systems and assets included in the database 
under paragraph (1) that the Secretary determines would, if destroyed 
or disrupted, cause national or regional catastrophic effects. 
(b) USE OF DATABASE.—The Secretary shall use the database estab-
lished under subsection (a)(1) in the development and implementation of 
Department plans and programs as appropriate. 
(c) MAINTENANCE OF DATABASE.— 
(1) IN GENERAL.—The Secretary shall maintain and annually up-
date the database established under subsection (a)(1) and the list es-
tablished under subsection (a)(2), including— 
(A) establishing data collection guidelines and providing the 
guidelines to the appropriate homeland security official of each 
State; 
(B) regularly reviewing the guidelines established under sub-
paragraph (A), including by consulting with the appropriate home-
land security officials of States, to solicit feedback about the 
guidelines, as appropriate; 
(C) after providing the homeland security official of a State 
with the guidelines under subparagraph (A), allowing the official 
a reasonable amount of time to submit to the Secretary data sub-
missions recommended by the official for inclusion in the database 
established under subsection (a)(1); 
(D) examining the contents and identifying submissions made 
by the official that are described incorrectly or that do not meet 
the guidelines established under subparagraph (A); and 
(E) providing to the appropriate homeland security official of 
each relevant State a list of submissions identified under subpara-
graph (D) for review and possible correction before the Secretary 
finalizes the decision of which submissions will be included in the 
database established under subsection (a)(1). 
(2) ORGANIZATION OF INFORMATION IN DATABASE.—The Secretary 
shall organize the contents of the database established under subsection 
(a)(1) and the list established under subsection (a)(2) as the Secretary 
determines is appropriate. Any organizational structure of the contents 
shall include the categorization of the contents— 
(A) according to the sectors listed in the National Infrastruc-
ture Protection Plan developed pursuant to Homeland Security 
Presidential Directive–7; and 
(B) by the State and county of their location. 
(3) PRIVATE-SECTOR INTEGRATION.—The Secretary shall identify 
and evaluate methods, including the Department’s Protected Critical 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
100 
Infrastructure Information Program, to acquire relevant private-sector 
information for the purpose of using that information to generate a 
database or list, including the database established under subsection 
(a)(1) and the list established under subsection (a)(2). 
(4) RETENTION OF CLASSIFICATION.—The classification of informa-
tion required to be provided to Congress, the Department, or another 
department or agency under this section by a sector-specific agency, in-
cluding the assignment of a level of classification of the information, 
shall be binding on Congress, the Department, and that other Federal 
agency. 
(d) REPORTS.— 
(1) ANNUAL REPORT REQUIRED.—The Secretary shall submit annu-
ally to the Committee on Homeland Security and Governmental Affairs 
of the Senate and the Committee on Homeland Security of the House 
of Representatives a report on the database established under sub-
section (a)(1) and the list established under subsection (a)(2). 
(2) CONTENTS.—Each report shall include the following: 
(A) The name, location, and sector classification of each of the 
systems and assets on the list established under subsection (a)(2). 
(B) The name, location, and sector classification of each of the 
systems and assets on the list that are determined by the Sec-
retary to be most at risk to terrorism. 
(C) Any significant challenges in compiling the list of the sys-
tems and assets included on the list or in the database established 
under subsection (a)(1). 
(D) Any significant changes from the preceding report in the 
systems and assets included on the list or in the database. 
(E) If appropriate, the extent to which the database and the list 
have been used, individually or jointly, for allocating funds by the 
Federal Government to prevent, reduce, mitigate, or respond to 
acts of terrorism. 
(F) The amount of coordination between the Department and 
the private sector, through an entity of the Department that meets 
with representatives of private-sector industries for purposes of co-
ordination, for the purpose of ensuring the accuracy of the data-
base and list. 
(G) Other information the Secretary deems relevant. 
(3) CLASSIFIED INFORMATION.—The report shall be submitted in 
unclassified form but may contain a classified annex. 
(e) NATIONAL INFRASTRUCTURE PROTECTION CONSORTIUM.—The Sec-
retary may establish the National Infrastructure Protection Consortium. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
101 
The National Infrastructure Protection Consortium may advise the Sec-
retary on the best way to identify, generate, organize, and maintain a data-
base or list of systems and assets established by the Secretary, including 
the database established under subsection (a)(1) and the list established 
under subsection (a)(2). If the Secretary establishes the National Infra-
structure Protection Consortium, the Consortium may— 
(1) be composed of national laboratories, Federal agencies, State and 
local homeland security organizations, academic institutions, or na-
tional Centers of Excellence that have demonstrated experience working 
with and identifying critical infrastructure and key resources; and 
(2) provide input to the Secretary on any request pertaining to the 
contents of the database or the list. 
§ 10517. Classified Information Advisory Officer 
(a) DESIGNATION.—The Secretary shall identify and designate in the De-
partment a Classified Information Advisory Officer. 
(b) RESPONSIBILITIES.—The responsibilities of the Classified Information 
Advisory Officer are as follows: 
(1) To develop and disseminate educational materials and to develop 
and administer training programs to assist State, local, and tribal gov-
ernments (including State, local, and tribal law enforcement agencies), 
and private-sector entities— 
(A) in developing plans and policies to respond to requests re-
lated to classified information without communicating the informa-
tion to individuals who lack appropriate security clearances; 
(B) regarding the appropriate procedures for challenging classi-
fication designations of information received by personnel of the 
entities; and 
(C) on the means by which personnel may apply for security 
clearances. 
(2) To inform the Under Secretary for Intelligence and Analysis on 
policies and procedures that could facilitate the sharing of classified in-
formation with the personnel, as appropriate. 
§ 10518. Annual report on intelligence activities of the De-
partment 
(a) IN GENERAL.—For each fiscal year and along with the budget mate-
rials submitted in support of the budget of the Department pursuant to sec-
tion 1105(a) of title 31, the Under Secretary for Intelligence and Analysis 
shall submit to the congressional intelligence committees a report for that 
fiscal year on each intelligence activity of each intelligence component of the 
Department, as designated by the Under Secretary, that includes the fol-
lowing: 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
102 
(1) The amount of funding requested for each intelligence activity. 
(2) The number of full-time employees funded to perform each intel-
ligence activity. 
(3) The number of full-time contractor employees (or the equivalent 
of full-time in the case of part-time contractor employees) funded to 
perform, or in support of, each intelligence activity. 
(4) A determination as to whether each intelligence activity is pre-
dominantly in support of national intelligence or departmental mission. 
(5) The total number of analysts of the Intelligence Enterprise of the 
Department who perform— 
(A) strategic analysis; or 
(B) operational analysis. 
(b) FEASIBILITY AND ADVISABILITY REPORT.—Not later than 120 days 
after December 19, 2014, the Secretary, acting through the Under Sec-
retary for Intelligence and Analysis, shall submit to the congressional intel-
ligence committees a report that— 
(1) examines the feasibility and advisability of including the budget 
request for all intelligence activities of each intelligence component of 
the Department that predominantly support departmental missions, as 
designed by the Under Secretary for Intelligence and Analysis, in the 
Homeland Security Intelligence Program; and 
(2) includes a plan to enhance the coordination of department-wide 
intelligence activities to achieve greater efficiencies in the performance 
of the intelligence functions of the Department. 
Subchapter II—Critical Infrastructure 
Information 
§ 10531. Definitions 
In this subchapter: 
(1) AGENCY.—The term ‘‘agency’’ has the meaning given the term 
in section 551 of title 5. 
(2) COVERED FEDERAL AGENCY.—The term ‘‘covered Federal agen-
cy’’ means the Department. 
(3) CRITICAL INFRASTRUCTURE INFORMATION.—The term ‘‘critical 
infrastructure information’’ means information not customarily in the 
public domain and related to the security of critical infrastructure or 
protected systems, including— 
(A) actual, potential, or threatened interference with, attack on, 
compromise of, or incapacitation of critical infrastructure or pro-
tected systems by either physical or computer-based attack or 
other similar conduct (including the misuse of or unauthorized ac-
cess to all types of communications and data transmission sys-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
103 
tems) that violates Federal, State, or local law, harms interstate 
commerce of the United States, or threatens public health or safe-
ty; 
(B) the ability of critical infrastructure or a protected system 
to resist interference, compromise, or incapacitation, including any 
planned or past assessment, projection, or estimate of the vulner-
ability of critical infrastructure or a protected system, including 
security testing, risk evaluation, risk management planning, or 
risk audit; and 
(C) a planned or past operational problem or solution regarding 
critical infrastructure or a protected system, including repair, re-
covery, reconstruction, insurance, or continuity, to the extent it is 
related to interference, compromise, or incapacitation. 
(4) CRITICAL INFRASTRUCTURE PROTECTION PROGRAM.—The term 
‘‘critical infrastructure protection program’’ means a component or bu-
reau of a covered Federal agency that has been designated by the 
President or an agency head to receive critical infrastructure informa-
tion. 
(5) CYBERSECURITY
RISK; INCIDENT.—The terms ‘‘cybersecurity 
risk’’ and ‘‘incident’’ have the meanings given the terms in section 
10545 of this title. 
(6) INFORMATION
SHARING
AND
ANALYSIS
ORGANIZATION.—The 
term ‘‘information sharing and analysis organization’’ means a formal 
or informal entity or collaboration created or employed by public- or 
private-sector organizations, for purposes of— 
(A) gathering and analyzing critical infrastructure information, 
including information relating to cybersecurity risks and incidents, 
to better understand security problems and interdependencies re-
lating to critical infrastructure, including cybersecurity risks and 
incidents, and protected systems, so as to ensure the availability, 
integrity, and reliability of the infrastructure and systems; 
(B) communicating or disclosing critical infrastructure informa-
tion, including cybersecurity risks and incidents, to help prevent, 
detect, mitigate, or recover from the effects of an interference, 
compromise, or incapacitation problem relating to critical infra-
structure, including cybersecurity risks and incidents, or protected 
systems; and 
(C) voluntarily disseminating critical infrastructure information, 
including cybersecurity risks and incidents, to its members, the 
Federal Government, State and local governments, or other enti-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
104 
ties that may be of assistance in carrying out the purposes speci-
fied in subparagraphs (A) and (B). 
(7) PROTECTED SYSTEM.—The term ‘‘protected system’’— 
(A) means a service, physical or computer-based system, proc-
ess, or procedure that directly or indirectly affects the viability of 
a facility of critical infrastructure; and 
(B) includes a physical or computer-based system, including a 
computer, computer system, computer or communications network, 
or any component hardware or element thereof, software program, 
processing instructions, or information or data in transmission or 
storage therein, irrespective of the medium of transmission or 
storage. 
(8) VOLUNTARY.— 
(A) IN GENERAL.—The term ‘‘voluntary’’, in the case of a sub-
mittal of critical infrastructure information to a covered Federal 
agency, means the submittal of the information in the absence of 
the agency’s exercise of legal authority to compel access to, or sub-
mission of, the information and may be accomplished by a single 
entity or an information sharing and analysis organization on be-
half of itself or its members. 
(B) EXCLUSIONS.—The term ‘‘voluntary’’— 
(i) in the case of an action brought under the securities 
laws as is defined in section 3(a) of the Securities Exchange 
Act of 1934 (15 U.S.C. 78c(a))— 
(I) does not include information or statements con-
tained in documents or materials filed with the Securities 
and Exchange Commission, or with Federal banking reg-
ulators, under section 12(i) of the Securities Exchange 
Act of 1934 (15 U.S.C. 78l(i)); and 
(II) with respect to the submittal of critical infrastruc-
ture information, does not include a disclosure or writing 
that when made accompanied the solicitation of an offer 
or a sale of securities; and 
(ii) does not include information or statements submitted 
or relied upon as a basis for making licensing or permitting 
determinations, or during regulatory proceedings. 
§ 10532. Designation of critical infrastructure protection 
program 
A critical infrastructure protection program may be designated as such 
by one of the following: 
(1) The President. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
105 
(2) The Secretary. 
§ 10533. Protection of voluntarily shared critical infrastruc-
ture information 
(a) PROTECTION.— 
(1) IN GENERAL.—Critical infrastructure information (including the 
identity of the submitting person or entity) that is voluntarily sub-
mitted to a covered Federal agency for use by that agency regarding 
the security of critical infrastructure and protected systems, analysis, 
warning, interdependency study, recovery, reconstitution, or other in-
formational purpose, when accompanied by an express statement speci-
fied in paragraph (2)— 
(A) shall be exempt from disclosure under section 552 of title 
5 (known as the Freedom of Information Act); 
(B) shall not be subject to agency rules or judicial doctrine re-
garding ex parte communications with a decision-making official; 
(C) shall not, without the written consent of the person or enti-
ty submitting the information, be used directly by the agency, an-
other Federal, State, or local authority, or a third party, in a civil 
action arising under Federal or State law if the information is 
submitted in good faith; 
(D) shall not, without the written consent of the person or enti-
ty submitting the information, be used or disclosed by an officer 
or employee of the United States for purposes other than the pur-
poses of this subchapter, except— 
(i) in furtherance of an investigation or the prosecution of 
a criminal act; or 
(ii) when disclosure of the information would be— 
(I) to either House of Congress, or to the extent of 
matter within its jurisdiction, a committee or sub-
committee of Congress (including a joint committee or 
subcommittee); or 
(II) to the Comptroller General, or an authorized rep-
resentative of the Comptroller General, in the course of 
the performance of the duties of the Government Ac-
countability Office; 
(E) shall not, if provided to a State or local government or gov-
ernment agency— 
(i) be made available pursuant to State or local law requir-
ing disclosure of information or records; 
(ii) otherwise be disclosed or distributed to a party by the 
State or local government or government agency without the 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
106 
written consent of the person or entity submitting the infor-
mation; or 
(iii) be used other than for the purpose of protecting crit-
ical infrastructure or protected systems, or in furtherance of 
an investigation or the prosecution of a criminal act; and 
(F) does not constitute a waiver of an applicable privilege or 
protection provided under law, such as trade secret protection. 
(2) EXPRESS STATEMENT.—For purposes of paragraph (1), the term 
‘‘express statement’’, with respect to information or records, means— 
(A) in the case of written information or records, a written 
marking on the information or records substantially similar to the 
following: ‘‘This information is voluntarily submitted to the Fed-
eral Government in expectation of protection from disclosure as 
provided by the provisions of the Critical Infrastructure Informa-
tion Act of 2002.’’; or 
(B) in the case of oral information, a similar written statement 
submitted within a reasonable period following the oral commu-
nication. 
(b) LIMITATION.—A communication of critical infrastructure information 
to a covered Federal agency made pursuant to this subchapter shall not be 
considered to be an action subject to the requirements of the Federal Advi-
sory Committee Act (5 U.S.C. App.). 
(c) INDEPENDENTLY OBTAINED INFORMATION.—Nothing in this section 
shall be construed to limit or otherwise affect the ability of a State, local, 
or Federal Government entity, agency, or authority, or a third party, under 
applicable law, to obtain critical infrastructure information in a manner not 
covered by subsection (a), including information lawfully and properly dis-
closed generally or broadly to the public and to use the information in any 
manner permitted by law. For purposes of this section, a permissible use 
of independently obtained information includes the disclosure of the infor-
mation under section 2302(b)(8) of title 5. 
(d) TREATMENT OF VOLUNTARY SUBMITTAL OF INFORMATION.—The 
voluntary submittal to the Government of information or records that are 
protected from disclosure by this subchapter shall not be construed to con-
stitute compliance with a requirement to submit the information to a Fed-
eral agency under any other provision of law. 
(e) PROCEDURES.— 
(1) IN GENERAL.—The Secretary shall, in consultation with appro-
priate representatives of the National Security Council and the Office 
of Science and Technology Policy, establish uniform procedures for the 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
107 
receipt, care, and storage by Federal agencies of critical infrastructure 
information that is voluntarily submitted to the Government. 
(2) ELEMENTS.—The procedures established under paragraph (1) 
shall include mechanisms regarding— 
(A) the acknowledgement of receipt by Federal agencies of crit-
ical infrastructure information that is voluntarily submitted to the 
Government; 
(B) the maintenance of the identification of the information as 
voluntarily submitted to the Government for purposes of, and sub-
ject to, the provisions of this subchapter; 
(C) the care and storage of the information; and 
(D) the protection and maintenance of the confidentiality of the 
information so as to permit the sharing of the information within 
the Federal Government and with State and local governments, 
and the issuance of notices and warnings related to the protection 
of critical infrastructure and protected systems, in a manner to 
protect from public disclosure the identity of the submitting per-
son or entity, or information that is proprietary, business sensitive, 
relates specifically to the submitting person or entity, and is other-
wise not appropriately in the public domain. 
(f) PENALTIES.—Whoever, being an officer or employee of the United 
States or of any department or agency thereof, knowingly publishes, di-
vulges, discloses, or makes known in any manner or to any extent not au-
thorized by law, any critical infrastructure information protected from dis-
closure by this subchapter coming to him or her in the course of this em-
ployment or official duties or by reason of any examination or investigation 
made by, or return, report, or record made to or filed with, the department 
or agency or officer or employee thereof, shall be fined under title 18, im-
prisoned not more than 1 year, or both, and shall be removed from office 
or employment. 
(g) AUTHORITY TO ISSUE WARNINGS.—The Federal Government may 
provide advisories, alerts, and warnings to relevant companies, targeted sec-
tors, other governmental entities, or the general public regarding potential 
threats to critical infrastructure as appropriate. In issuing a warning, the 
Federal Government shall take appropriate actions to protect from disclo-
sure— 
(1) the source of voluntarily submitted critical infrastructure infor-
mation that forms the basis for the warning; or 
(2) information that is proprietary, business sensitive, relates specifi-
cally to the submitting person or entity, or is otherwise not appro-
priately in the public domain. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
108 
(h) AUTHORITY TO DELEGATE.—The President may delegate authority 
to a critical infrastructure protection program, designated under section 
10532 of this title, to enter into a voluntary agreement to promote critical 
infrastructure security, including with an information sharing and analysis 
organization, or a plan of action as otherwise defined in section 708 of the 
Defense Production Act of 1950 (50 U.S.C. 4558). 
§ 10534. No private right of action 
Nothing in this subchapter may be construed to create a private right of 
action for enforcement of a provision of this subtitle. 
Subchapter III—Information Security 
Part A—Department Duties and Powers 
§ 10541. Procedures for sharing information 
The Secretary shall establish procedures on the use of information shared 
under this chapter that— 
(1) limit the re-dissemination of the information to ensure that it is 
not used for an unauthorized purpose; 
(2) ensure the security and confidentiality of the information; 
(3) protect the constitutional and statutory rights of individuals who 
are subjects of the information; and 
(4) provide data integrity through the timely removal and destruc-
tion of obsolete or erroneous names and information. 
§ 10542. Cybersecurity collaboration between the Depart-
ment and the Department of Defense 
(a) INTERDEPARTMENTAL COLLABORATION.— 
(1) IN GENERAL.—The Secretary and the Secretary of Defense shall 
provide personnel, equipment, and facilities to increase interdepart-
mental collaboration with respect to— 
(A) strategic planning for the cybersecurity of the United 
States; 
(B) mutual support for cybersecurity capabilities development; 
and 
(C) synchronization of current operational cybersecurity mission 
activities. 
(2) EFFICIENCIES.—The collaboration provided for under paragraph 
(1) shall be designed— 
(A) to improve the efficiency and effectiveness of requirements 
formulation and requests for products, services, and technical as-
sistance for, and coordination and performance assessment of, cy-
bersecurity missions executed across a variety of elements of the 
Department and the Department of Defense; and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
109 
(B) to leverage the expertise of the Department and the Depart-
ment of Defense and to avoid duplicating, replicating, or aggre-
gating unnecessarily the diverse line organizations across tech-
nology developments, operations, and customer support that collec-
tively execute the cybersecurity mission of the Department and the 
Department of Defense. 
(b) RESPONSIBILITIES.— 
(1) SECRETARY.—The Secretary shall identify and assign, in coordi-
nation with the Secretary of Defense, a Director of Cybersecurity Co-
ordination in the Department to undertake collaborative activities with 
the Department of Defense. 
(2) SECRETARY OF DEFENSE.—The Secretary of Defense shall iden-
tify and assign, in coordination with the Secretary, one or more offi-
cials in the Department of Defense to coordinate, oversee, and execute 
collaborative activities and the provision of cybersecurity support to the 
Department. 
§ 10543. Privacy officer 
(a) APPOINTMENT AND RESPONSIBILITIES.—The Secretary shall appoint 
a senior official in the Department, who shall report directly to the Sec-
retary, to assume primary responsibility for privacy policy, including— 
(1) assuring that the use of technologies sustain, and do not erode, 
privacy protections relating to the use, collection, and disclosure of per-
sonal information; 
(2) assuring that personal information contained in Privacy Act sys-
tems of records is handled in full compliance with fair information 
practices as set out in section 552a of title 5 (known as the ‘‘Privacy 
Act of 1974’’); 
(3) evaluating legislative and regulatory proposals involving collec-
tion, use, and disclosure of personal information by the Federal Gov-
ernment; 
(4) conducting a privacy impact assessment of proposed rules of the 
Department or that of the Department on the privacy of personal in-
formation, including the type of personal information collected and the 
number of people affected; 
(5) coordinating with the Officer for Civil Rights and Civil Liberties 
to ensure that— 
(A) programs, policies, and procedures involving civil rights, 
civil liberties, and privacy considerations are addressed in an inte-
grated and comprehensive manner; and 
(B) Congress receives appropriate reports on the programs, poli-
cies, and procedures; and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
110 
(6) preparing a report to Congress on an annual basis on activities 
of the Department that affect privacy, including complaints of privacy 
violations, implementation of section 552a of title 5 (known as the 
‘‘Privacy Act of 1974’’), internal controls, and other matters. 
(b) AUTHORITY TO INVESTIGATE.— 
(1) IN GENERAL.—The senior official appointed under subsection (a) 
may— 
(A) have access to all records, reports, audits, reviews, docu-
ments, papers, recommendations, and other materials available to 
the Department that relate to programs and operations with re-
spect to the responsibilities of the senior official under this section; 
(B) make investigations and reports relating to the administra-
tion of the programs and operations of the Department that are, 
in the senior official’s judgment, necessary or desirable; 
(C) subject to the approval of the Secretary, require by sub-
poena the production, by any person other than a Federal agency, 
of all information, documents, reports, answers, records, accounts, 
papers, and other data and documentary evidence necessary to the 
performance of the responsibilities of the senior official under this 
section; and 
(D) administer to, or take from, a person an oath, affirmation, 
or affidavit, whenever necessary to the performance of the respon-
sibilities of the senior official under this section. 
(2) ENFORCEMENT OF SUBPOENAS.—A subpoena issued under para-
graph (1)(C) shall, in the case of contumacy or refusal to obey, be en-
forceable by order of an appropriate United States district court. 
(3) EFFECT OF OATHS.—An oath, affirmation, or affidavit adminis-
tered or taken under paragraph (1)(D) by or before an employee of the 
Privacy Office designated for that purpose by the senior official ap-
pointed under subsection (a) shall have the same force and effect as 
if administered or taken by or before an officer having a seal of office. 
(c) SUPERVISION AND COORDINATION.— 
(1) IN GENERAL.—The senior official appointed under subsection (a) 
shall— 
(A) report to, and be under the general supervision of, the Sec-
retary; and 
(B) coordinate activities with the Inspector General of the De-
partment in order to avoid duplication of effort. 
(2) COORDINATION WITH INSPECTOR GENERAL.— 
(A) IN GENERAL.—Except as provided in subparagraph (B), the 
senior official appointed under subsection (a) may investigate a 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
111 
matter relating to possible violations or abuse concerning the ad-
ministration of a program or operation of the Department relevant 
to the purposes under this section. 
(B) COORDINATION.— 
(i) REFERRAL TO INSPECTOR GENERAL.—Before initiating 
an investigation described under subparagraph (A), the senior 
official shall refer the matter and all related complaints, alle-
gations, and information to the Inspector General of the De-
partment. 
(ii) DETERMINATION.—Not later than 30 days after the re-
ceipt of a matter referred under clause (i), the Inspector Gen-
eral shall— 
(I) make a determination regarding whether the In-
spector General intends to initiate an audit or investiga-
tion of the matter referred under clause (i); and 
(II) notify the senior official of that determination. 
(iii) NOTIFICATION THAT AUDIT NOT INITIATED.—If the 
Inspector General notifies the senior official that the Inspec-
tor General intends to initiate an audit or investigation, but 
does not initiate that audit or investigation within 90 days 
after providing that notification, the Inspector General shall 
further notify the senior official that an audit or investigation 
was not initiated. The further notification under this clause 
shall be made not later than 3 days after the end of that 90- 
day period. 
(iv) INVESTIGATION BY SENIOR OFFICIAL.—The senior offi-
cial may investigate a matter referred under clause (i) if— 
(I) the Inspector General notifies the senior official 
under clause (ii) that the Inspector General does not in-
tend to initiate an audit or investigation relating to that 
matter; or 
(II) the Inspector General provides a further notifica-
tion under clause (iii) relating to that matter. 
(v) TRAINING.—An employee of the Office of Inspector 
General who audits or investigates a matter referred under 
clause (i) shall be required to receive adequate training on 
privacy laws, rules, and regulations, to be provided by an en-
tity approved by the Inspector General in consultation with 
the senior official appointed under subsection (a). 
(d) NOTIFICATION TO CONGRESS ON REMOVAL.—If the Secretary re-
moves the senior official appointed under subsection (a) or transfers that 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
112 
senior official to another position or location within the Department, the 
Secretary shall— 
(1) promptly submit a written notification of the removal or transfer 
to both Houses of Congress; and 
(2) include in a notification the reasons for the removal or transfer. 
(e) REPORTS BY SENIOR OFFICIAL TO CONGRESS.—The senior official 
appointed under subsection (a) shall— 
(1) submit reports directly to Congress regarding performance of the 
responsibilities of the senior official under this section, without prior 
comment or amendment by the Secretary, Deputy Secretary of Home-
land Security, or any other officer or employee of the Department or 
the Office of Management and Budget; and 
(2) inform the Committee on Homeland Security and Governmental 
Affairs of the Senate and the Committee on Homeland Security of the 
House of Representatives not later than— 
(A) 30 days after the Secretary disapproves the senior official’s 
request for a subpoena under subsection (b)(1)(C) or the Sec-
retary substantively modifies the requested subpoena; or 
(B) 45 days after the senior official’s request for a subpoena 
under subsection (b)(1)(C), if that subpoena has not either been 
approved or disapproved by the Secretary. 
§ 10544. Enhancement of Federal and non-Federal cyberse-
curity 
In carrying out the responsibilities under section 10501 of this title, the 
Under Secretary appointed under section 10302(b)(1)(H) of this title 
shall— 
(1) as appropriate, provide to State and local government entities, 
and upon request to private entities that own or operate critical infor-
mation systems— 
(A) analysis and warnings related to threats to, and 
vulnerabilities of, critical information systems; and 
(B) crisis management support in response to threats to, or at-
tacks on, critical information systems; 
(2) as appropriate, provide technical assistance, upon request, to the 
private sector and other government entities, with respect to emergency 
recovery plans to respond to major failures of critical information sys-
tems; and 
(3) fulfill the responsibilities of the Secretary to protect Federal in-
formation systems under subchapter II of chapter 35 of title 44. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
113 
§ 10545. National Cybersecurity and Communications Inte-
gration Center 
(a) DEFINITIONS.—In this section— 
(1) CYBERSECURITY RISK.—The term ‘‘cybersecurity risk’’— 
(A) means threats to and vulnerabilities of information or infor-
mation systems and any related consequences caused by or result-
ing from unauthorized access, use, disclosure, degradation, disrup-
tion, modification, or destruction of the information or information 
systems, including related consequences caused by an act of ter-
rorism; and 
(B) does not include an action that solely involves a violation 
of a consumer term of service or a consumer licensing agreement. 
(2) CYBER THREAT INDICATOR; DEFENSIVE MEASURE.—The terms 
‘‘cyber threat indicator’’ and ‘‘defensive measure’’ have the meanings 
given the terms in section 10561 of this title. 
(3) INCIDENT.—The term ‘‘incident’’ means an occurrence that actu-
ally or imminently jeopardizes, without lawful authority — 
(A) the integrity, confidentiality, or availability of information 
on an information system; or 
(B) an information system. 
(4) INFORMATION
SHARING
AND
ANALYSIS
ORGANIZATION.—The 
term ‘‘information sharing and analysis organization’’ has the meaning 
given that term in section 10531 of this title. 
(5) INFORMATION SYSTEM.—The term ‘‘information system’’ has the 
meaning given that term in section 3502(8) of title 44. 
(6) SHARING.—The term ‘‘sharing’’ means providing, receiving, and 
disseminating. 
(b) NATIONAL CYBERSECURITY
AND COMMUNICATIONS INTEGRATION 
CENTER.—There is in the Department the National Cybersecurity and 
Communications Integration Center (referred to in this section as the ‘‘Cen-
ter’’) to carry out certain responsibilities of the Under Secretary appointed 
under section 10302(b)(1)(H) of this title. 
(c) FUNCTIONS.—The cybersecurity functions of the Center shall in-
clude— 
(1) being a Federal civilian interface for the multi-directional and 
cross-sector sharing of information relating to cyber threat indicators, 
defensive measures, cybersecurity risks, incidents, analysis, and warn-
ings for Federal and non-Federal entities, including the implementation 
of part B of this subchapter; 
(2) providing shared situational awareness to enable real-time, inte-
grated, and operational actions across the Federal Government and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
114 
non-Federal entities to address cybersecurity risks and incidents to 
Federal and non-Federal entities; 
(3) coordinating the sharing of information relating to cyber threat 
indicators, defensive measures, cybersecurity risks, and incidents across 
the Federal Government; 
(4) facilitating cross-sector coordination to address cybersecurity 
risks and incidents, including cybersecurity risks and incidents that 
may be related or could have consequential impacts across multiple sec-
tors; 
(5)(A) conducting integration and analysis, including cross-sector in-
tegration and analysis, of cyber threat indicators, defensive measures, 
cybersecurity risks, and incidents; and 
(B) sharing the analysis conducted under subparagraph (A) with 
Federal and non-Federal entities; 
(6) on request, providing timely technical assistance, risk manage-
ment support, and incident response capabilities to Federal and non- 
Federal entities with respect to cyber threat indicators, defensive meas-
ures, cybersecurity risks, and incidents, which may include attribution, 
mitigation, and remediation; 
(7) providing information and recommendations on security and re-
silience measures to Federal and non-Federal entities, including infor-
mation and recommendations to— 
(A) facilitate information security; 
(B) strengthen information systems against cybersecurity risks 
and incidents; and 
(C) share cyber threat indicators and defensive measures; 
(8) engaging with international partners, in consultation with other 
appropriate agencies, to— 
(A) collaborate on cyber threat indicators, defensive measures, 
and information relating to cybersecurity risks and incidents; and 
(B) enhance the security and resilience of global cybersecurity; 
(9) sharing cyber threat indicators, defensive measures, and other in-
formation relating to cybersecurity risks and incidents with Federal 
and non-Federal entities, including across sectors of critical infrastruc-
ture, and with State and major urban area fusion centers, as appro-
priate; 
(10) participating, as appropriate, in national exercises run by the 
Department; and 
(11) in coordination with the Office of Emergency Communications 
of the Department, assessing and evaluating consequence, vulnerability, 
and threat information regarding cyber incidents to public safety com-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
115 
munications to help facilitate continuous improvements to the security 
and resiliency of the communications. 
(d) COMPOSITION.— 
(1) IN GENERAL.—The Center is composed of— 
(A) appropriate representatives of Federal entities, such as— 
(i) sector-specific agencies; 
(ii) civilian and law enforcement agencies; and 
(iii) elements of the intelligence community, as that term 
is defined under section 3 of the National Security Act of 
1947 (50 U.S.C. 3003); 
(B) appropriate representatives of non-Federal entities, such 
as— 
(i) State and local governments; 
(ii) information sharing and analysis organizations; and 
(iii) owners and operators of critical information systems; 
(C) components in the Center that carry out cybersecurity and 
communications activities; 
(D) a designated Federal official for operational coordination 
with and across each sector; and 
(E) other appropriate representatives or entities, as determined 
by the Secretary. 
(2) INCIDENTS.—In the event of an incident, during exigent cir-
cumstances the Secretary may grant a Federal or non-Federal entity 
immediate temporary access to the Center. 
(e) PRINCIPLES.—In carrying out the functions under subsection (c), the 
Center shall ensure— 
(1) to the extent practicable, that— 
(A) timely, actionable, and relevant information related to cy-
bersecurity risks, incidents, and analysis is shared; 
(B) when appropriate, information related to cybersecurity 
risks, incidents, and analysis is integrated with other relevant in-
formation and tailored to the specific characteristics of a sector; 
(C) activities are prioritized and conducted based on the level 
of risk; 
(D) industry sector-specific, academic, and national laboratory 
expertise is sought and receives appropriate consideration; 
(E) continuous, collaborative, and inclusive coordination oc-
curs— 
(i) across sectors; and 
(ii) with— 
(I) sector coordinating councils; 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
116 
(II) information sharing and analysis organizations; 
and 
(III) other appropriate non-Federal partners; 
(F) as appropriate, the Center works to develop and use mecha-
nisms for sharing information related to cybersecurity risks and 
incidents that are technology-neutral, interoperable, real-time, 
cost-effective, and resilient; and 
(G) the Center works with other agencies to reduce unneces-
sarily duplicative sharing of information related to cybersecurity 
risks and incidents; 
(2) that information related to cybersecurity risks and incidents is 
appropriately safeguarded against unauthorized access; and 
(3) that activities conducted by the Center comply with all policies, 
regulations, and laws that protect the privacy and civil liberties of 
United States persons. 
(f) NO RIGHT OR BENEFIT.— 
(1) IN GENERAL.—The provision of assistance or information to, and 
inclusion in the Center of, governmental or private entities under this 
section shall be at the sole and unreviewable discretion of the Under 
Secretary appointed under section 10302(b)(1)(H) of this title. 
(2) CERTAIN ASSISTANCE OR INFORMATION.—The provision of cer-
tain assistance or information to, or inclusion in the Center of, one gov-
ernmental or private entity pursuant to this section shall not create a 
right or benefit, substantive or procedural, to similar assistance or in-
formation for any other governmental or private entity. 
(g) AUTOMATED INFORMATION SHARING.— 
(1) IN GENERAL.—The Under Secretary appointed under section 
10302(b)(1)(H) of this title, in coordination with industry and other 
stakeholders, shall develop capabilities making use of existing informa-
tion technology industry standards and best practices, as appropriate, 
that support and rapidly advance the development, adoption, and im-
plementation of automated mechanisms for the sharing of cyber threat 
indicators and defensive measures in accordance with part B of this 
subchapter. 
(2) ANNUAL REPORT.—The Under Secretary appointed under sec-
tion 10302(b)(1)(H) of this title shall submit to the Committee on 
Homeland Security and Governmental Affairs of the Senate and the 
Committee on Homeland Security of the House of Representatives an 
annual report on the status and progress of the development of the ca-
pabilities described in paragraph (1). The reports shall be required 
until the capabilities are fully implemented. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
117 
(h) VOLUNTARY INFORMATION SHARING PROCEDURES AND RELATION-
SHIPS.— 
(1) PROCEDURES.— 
(A) IN GENERAL.—The Center may enter into a voluntary in-
formation sharing relationship with any consenting non-Federal 
entity for the sharing of cyber threat indicators and defensive 
measures for cybersecurity purposes in accordance with this sec-
tion. Nothing in this subsection may be construed to require any 
non-Federal entity to enter into an information sharing relation-
ship with the Center or any other entity. The Center may termi-
nate a voluntary information sharing relationship under this sub-
section, at the sole and unreviewable discretion of the Secretary, 
acting through the Under Secretary appointed under section 
10302(b)(1)(H) of this title, for any reason, including if the Cen-
ter determines that the non-Federal entity with which the Center 
has entered into the relationship has violated the terms of this 
subsection. 
(B) NATIONAL SECURITY.—The Secretary may decline to enter 
into a voluntary information sharing relationship under this sub-
section, at the sole and unreviewable discretion of the Secretary, 
acting through the Under Secretary appointed under section 
10302(b)(1)(H) of this title, for any reason, including if the Sec-
retary determines that declining to enter into the relationship is 
appropriate for national security. 
(2) RELATIONSHIPS.—A voluntary information sharing relationship 
under this subsection may be characterized as an agreement described 
as follows: 
(A) For the use of a non-Federal entity, the Center shall make 
available a standard agreement, consistent with this section, on 
the Department’s website. 
(B) At the request of a non-Federal entity, and if determined 
appropriate by the Center, at the sole and unreviewable discretion 
of the Secretary, acting through the Under Secretary appointed 
under section 10302(b)(1)(H) of this title, the Department shall 
negotiate a non-standard agreement, consistent with this section. 
(C) An agreement between the Center and a non-Federal entity 
that was entered into, or that was in effect, before December 18, 
2015, shall be deemed in compliance with the requirements of this 
subsection. An agreement under this subsection shall include the 
relevant privacy protections as in effect under the Cooperative Re-
search and Development Agreement for Cybersecurity Information 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00117
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
118 
Sharing and Collaboration, as of December 31, 2014. Nothing in 
this subsection may be construed to require a non-Federal entity 
to enter into either a standard or negotiated agreement to be in 
compliance with this subsection. 
(i) DIRECT REPORTING.—The Secretary shall develop policies and proce-
dures for direct reporting to the Secretary by the Director of the Center 
regarding significant cybersecurity risks and incidents. 
(j) REPORTS ON INTERNATIONAL COOPERATION.—The Secretary periodi-
cally shall submit to the Committee on Homeland Security and Govern-
mental Affairs of the Senate and the Committee on Homeland Security of 
the House of Representatives a report on the range of efforts underway to 
bolster cybersecurity collaboration with relevant international partners in ac-
cordance with subsection (c)(8). 
(k) OUTREACH.—The Secretary, acting through the Under Secretary ap-
pointed under section 10302(b)(1)(H) of this title, shall— 
(1) disseminate to the public information about how to voluntarily 
share cyber threat indicators and defensive measures with the Center; 
and 
(2) enhance outreach to critical infrastructure owners and operators 
for purposes of sharing cyber threat indicators and defensive measures 
with the Center. 
(l) CYBERSECURITY OUTREACH.— 
(1) DEFINITIONS.—For purposes of this subsection, the terms 
‘‘small business concern’’ and ‘‘small business development center’’ 
have the meanings given the terms in section 3 of the Small Business 
Act (15 U.S.C. 632). 
(2) PROVIDE ASSISTANCE.—The Secretary may leverage small busi-
ness development centers to provide assistance to small business con-
cerns by disseminating information on cyber threat indicators, defense 
measures, cybersecurity risks, incidents, analyses, and warnings to help 
small business concerns in developing or enhancing cybersecurity infra-
structure, awareness of cyber threat indicators, and cyber training pro-
grams for employees. 
(m) COORDINATED VULNERABILITY DISCLOSURE.—The Secretary, in co-
ordination with industry and other stakeholders, may develop and adhere to 
Department policies and procedures for coordinating vulnerability disclo-
sures. 
§ 10546. Cybersecurity plans 
(a) DEFINITIONS.—In this section: 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
119 
(1) AGENCY INFORMATION SYSTEM.—The term ‘‘agency information 
system’’ means an information system used or operated by an agency 
or by another entity on behalf of an agency. 
(2) CYBERSECURITY RISK; INFORMATION SYSTEM.—The terms ‘‘cy-
bersecurity risk’’ and ‘‘information system’’ have the meanings given 
the terms in section 10545 of this title. 
(3) INTELLIGENCE
COMMUNITY.—The term ‘‘intelligence commu-
nity’’ has the meaning given the term in section 3 of the National Se-
curity Act of 1947 (50 U.S.C. 3003). 
(4) NATIONAL SECURITY SYSTEM.—The term ‘‘national security sys-
tem’’ has the meaning given the term in section 11103 of title 40. 
(b) INTRUSION ASSESSMENT PLAN.— 
(1) REQUIREMENT.—The Secretary, in coordination with the Direc-
tor of the Office of Management and Budget, shall— 
(A) develop and implement an intrusion assessment plan to 
proactively detect, identify, and remove intruders in agency infor-
mation systems on a routine basis; and 
(B) update the plan as necessary. 
(2) EXCEPTION.—The intrusion assessment plan required under 
paragraph (1) shall not apply to the Department of Defense, a national 
security system, or an element of the intelligence community. 
(c) CYBER INCIDENT RESPONSE PLANS.—The Under Secretary ap-
pointed under section 10302(b)(1)(H) of this title shall, in coordination with 
appropriate Federal departments and agencies, State and local governments, 
sector coordinating councils, information sharing and analysis organizations 
(as defined in section 10531 of this title), owners and operators of critical 
infrastructure, and other appropriate entities and individuals, develop, regu-
larly update, maintain, and exercise adaptable cyber incident response plans 
to address cybersecurity risks (as defined in section 10545 of this title) to 
critical infrastructure. 
(d) NATIONAL RESPONSE FRAMEWORK.—The Secretary, in coordination 
with the heads of other appropriate Federal departments and agencies, and 
in accordance with the National Cybersecurity Incident Response Plan re-
quired under subsection (c), shall regularly update, maintain, and exercise 
the Cyber Incident Annex to the National Response Framework of the De-
partment. 
§ 10547. NET Guard 
The Assistant Secretary for Infrastructure Protection may establish a na-
tional technology guard, to be known as ‘‘NET Guard’’, comprised of local 
teams of volunteers with expertise in relevant areas of science and tech-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00119
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
120 
nology, to assist local communities to respond and recover from attacks on 
information systems and communications networks. 
§ 10548. Prohibition on new regulatory authority 
(a) IN GENERAL.—Nothing in the National Cybersecurity Protection Act 
of 2014 (Public Law 113–282, 128 Stat. 3066) or the amendments made 
by the Act shall be construed to grant the Secretary any authority to pro-
mulgate regulations or set standards relating to the cybersecurity of private- 
sector critical infrastructure that was not in effect on December 17, 2014. 
(b) PRIVATE ENTITIES.—Nothing in the National Cybersecurity Protec-
tion Act of 2014 (Public Law 113–282, 128 Stat. 3066) or the amendments 
made by the Act shall be construed to require any private entity— 
(1) to request assistance from the Secretary; or 
(2) that requested assistance from the Secretary to implement any 
measure or recommendation suggested by the Secretary. 
§ 10549.
Federal intrusion detection and prevention system 
(a) DEFINITIONS.—In subsections (a) through (f) of this section: 
(1) AGENCY.—The term ‘‘agency’’ has the meaning given the term 
in section 3502 of title 44. 
(2) AGENCY INFORMATION.—The term ‘‘agency information’’ means 
information collected or maintained by or on behalf of an agency. 
(3) AGENCY INFORMATION SYSTEM.—The term ‘‘agency information 
system’’ has the meaning given the term in section 10546 of this title. 
(4) CYBERSECURITY RISK, INFORMATION SYSTEM.—The terms ‘‘cy-
bersecurity risk’’ and ‘‘information system’’ have the meanings given 
the terms in section 10545 of this title. 
(b) DEPLOYMENT, OPERATION, AND MAINTENANCE OF CAPABILITIES.— 
(1) IN GENERAL.—Not later than December 18, 2016, the Secretary 
shall deploy, operate, and maintain, to make available for use by any 
agency, with or without reimbursement— 
(A) a capability to detect cybersecurity risks in network traffic 
transiting or traveling to or from an agency information system; 
and 
(B) a capability to— 
(i) prevent network traffic associated with those cybersecu-
rity risks from transiting or traveling to or from an agency 
information system; or 
(ii) modify the network traffic to remove the cybersecurity 
risk. 
(2) REGULAR IMPROVEMENT.—The Secretary shall regularly deploy 
new technologies and modify existing technologies to the intrusion de-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00120
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
121 
tection and prevention capabilities described in paragraph (1) as appro-
priate to improve the intrusion detection and prevention capabilities. 
(c) ACTIVITIES.—In carrying out subsection (b), the Secretary— 
(1) may access, and the head of an agency may disclose to the Sec-
retary or a private entity providing assistance to the Secretary under 
paragraph (2), information transiting or traveling to or from an agency 
information system, regardless of the location from which the Secretary 
or a private entity providing assistance to the Secretary under para-
graph (2) accesses the information, notwithstanding any other provi-
sion of law that would otherwise restrict or prevent the head of an 
agency from disclosing the information to the Secretary or a private 
entity providing assistance to the Secretary under paragraph (2); 
(2) may enter into contracts or other agreements with, or otherwise 
request and obtain the assistance of, private entities to deploy, operate, 
and maintain technologies in accordance with subsection (b); 
(3) may retain, use, and disclose information obtained through the 
conduct of activities authorized under this section only to protect infor-
mation and information systems from cybersecurity risks; 
(4) shall regularly assess, through operational test and evaluation in 
real world or simulated environments, available advanced protective 
technologies to improve detection and prevention capabilities, including 
commercial and noncommercial technologies and detection technologies 
beyond signature-based detection, and acquire, test, and deploy the 
technologies when appropriate; 
(5) shall establish a pilot through which the Secretary may acquire, 
test, and deploy, as rapidly as possible, technologies described in para-
graph (4); and 
(6) shall periodically update the privacy impact assessment required 
under section 208(b) of the E-Government Act of 2002 (44 U.S.C. 
3501 note). 
(d) PRINCIPLES.—In carrying out subsection (b), the Secretary shall en-
sure that— 
(1) activities carried out under this section are reasonably necessary 
for the purpose of protecting agency information and agency informa-
tion systems from a cybersecurity risk; 
(2) information accessed by the Secretary will be retained no longer 
than reasonably necessary for the purpose of protecting agency infor-
mation and agency information systems from a cybersecurity risk; 
(3) notice has been provided to users of an agency information sys-
tem concerning access to communications of users of the agency infor-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00121
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
122 
mation system for the purpose of protecting agency information and 
the agency information system; and 
(4) the activities are implemented pursuant to policies and proce-
dures governing the operation of the intrusion detection and prevention 
capabilities. 
(e) PRIVATE ENTITIES.— 
(1) CONDITIONS.—A private entity described in subsection (c)(2) 
may not— 
(A) disclose any network traffic transiting or traveling to or 
from an agency information system to any entity other than the 
Department or the agency that disclosed the information under 
subsection (c)(1), including personal information of a specific indi-
vidual or information that identifies a specific individual not di-
rectly related to a cybersecurity risk; or 
(B) use any network traffic transiting or traveling to or from 
an agency information system to which the private entity gains ac-
cess in accordance with this section for any purpose other than to 
protect agency information and agency information systems 
against cybersecurity risks or to administer a contract or other 
agreement entered into pursuant to subsection (c)(2) or as part 
of another contract with the Secretary. 
(2) LIMITATION ON LIABILITY.—No cause of action shall lie in any 
court against a private entity for assistance provided to the Secretary 
in accordance with this section and any contract or agreement entered 
into pursuant to subsection (c)(2). 
(3) RULE OF CONSTRUCTION.—Nothing in paragraph (2) shall be 
construed to authorize an Internet service provider to break a user 
agreement with a customer without the consent of the customer. 
(f) PRIVACY OFFICER REVIEW.—Not later than December 18, 2016, the 
Privacy Officer appointed under section 10543 of this title, in consultation 
with the Attorney General, shall review the policies and guidelines for the 
program carried out under this section to ensure that the policies and guide-
lines are consistent with applicable privacy laws, including those governing 
the acquisition, interception, retention, use, and disclosure of communica-
tions. 
(g) AGENCY RESPONSIBILITIES.— 
(1) DEFINITION OF AGENCY INFORMATION SYSTEM.—In this sub-
section, the term ‘‘agency information system’’ means an information 
system owned or operated by an agency. 
(2) IN GENERAL.—Except as provided in paragraph (3)— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00122
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
123 
(A) not later than December 18, 2016, or 2 months after the 
date on which the Secretary makes available the intrusion detec-
tion and prevention capabilities under subsection (b)(1), whichever 
is later, the head of each agency shall apply and continue to utilize 
the capabilities to all information traveling between an agency in-
formation system and another information system; and 
(B) not later than 6 months after the date on which the Sec-
retary makes available improvements to the intrusion detection 
and prevention capabilities pursuant to subsection (b)(2), the head 
of each agency shall apply and continue to utilize the improved in-
trusion detection and prevention capabilities. 
(3) EXCEPTION.—The requirements under paragraph (2) shall not 
apply to the Department of Defense, a national security system, or an 
element of the intelligence community. 
(4) RULE OF CONSTRUCTION.—Nothing in this subsection shall be 
construed to limit an agency from applying the intrusion detection and 
prevention capabilities to an information system other than an agency 
information system under subsection (b)(1) at the discretion of the 
head of the agency or as provided in relevant policies, directives, and 
guidelines. 
(h) RULE OF CONSTRUCTION.—Nothing in subsection (i) shall be con-
strued to affect the limitation of liability of a private entity for assistance 
provided to the Secretary under subsection (d)(2) if the assistance was ren-
dered before the termination date under subsection (i) or otherwise during 
a period in which the assistance was authorized. 
(i) TERMINATION.—The requirements under subsections (a) through (f) 
of this section terminate on December 18, 2022. 
§ 10550. Cybersecurity strategy 
(a) DEFINITION OF HOMELAND SECURITY ENTERPRISE.—In this section, 
the term ‘‘Homeland Security Enterprise’’ means relevant governmental and 
nongovernmental entities involved in homeland security, including Federal, 
State, local, and tribal government officials, private-sector representatives, 
academics, and other policy experts. 
(b) DEVELOPMENT OF STRATEGY.—The Secretary shall develop a depart-
mental strategy to carry out cybersecurity responsibilities as set forth by 
law. 
(c) CONTENTS.—The strategy required under subsection (b) shall include 
the following: 
(1) Strategic and operational goals and priorities to successfully exe-
cute the full range of the Secretary’s cybersecurity responsibilities. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00123
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
124 
(2) Information on the programs, policies, and activities that are re-
quired to successfully execute the full range of the Secretary’s cyberse-
curity responsibilities, including programs, policies, and activities in 
furtherance of the following: 
(A) Cybersecurity functions set forth in section 10545 of this 
title. 
(B) Cybersecurity investigation capabilities. 
(C) Cybersecurity research and development. 
(D) Engagement with international cybersecurity partners. 
(d) CONSIDERATIONS.—In developing the strategy required under sub-
section (b), the Secretary shall— 
(1) consider— 
(A) the cybersecurity strategy for the Homeland Security Enter-
prise published by the Secretary in November 2011; 
(B) the Department of Homeland Security Fiscal Years 2014– 
2018 Strategic Plan; and 
(C) the most recent Quadrennial Homeland Security Review 
issued pursuant to section 11506 of this title; and 
(2) include information on the roles and responsibilities of compo-
nents and offices of the Department, to the extent practicable, to carry 
out the strategy. 
(e) IMPLEMENTATION PLAN.—Not later than 90 days after the develop-
ment of the strategy required under subsection (b), the Secretary shall issue 
an implementation plan for the strategy that includes the following: 
(1) Strategic objectives and corresponding tasks. 
(2) Projected timelines and costs for the tasks. 
(3) Metrics to evaluate performance of the tasks. 
(f) CONGRESSIONAL OVERSIGHT.—The Secretary shall submit to Con-
gress for assessment the following: 
(1) A copy of the strategy required under subsection (b) on issuance. 
(2) A copy of the implementation plan required under subsection (e), 
on issuance, together with detailed information on any associated legis-
lative or budgetary proposals. 
(g) CLASSIFED INFORMATION.—The strategy required under subsection 
(b) shall be in an unclassified form but may contain a classified annex. 
(h) RULE OF CONSTRUCTION.—Nothing in this section may be construed 
as permitting the Department to engage in monitoring, surveillance, 
exfiltration, or other collection activities for the purpose of tracking an indi-
vidual’s personally identifiable information. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00124
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
125 
Part B—Cybersecurity Information 
Sharing 
§ 10561. Definitions 
In this part: 
(1) AGENCY.—The term ‘‘agency’’ has the meaning given the term 
in section 3502 of title 44. 
(2) ANTITRUST LAWS.—The term ‘‘antitrust laws’’— 
(A) has the meaning given the term in the 1st section of the 
Clayton Act (15 U.S.C. 12); 
(B) includes section 5 of the Federal Trade Commission Act (15 
U.S.C. 45) to the extent that section 5 of that Act applies to un-
fair competition; and 
(C) includes any State antitrust law, but only to the extent that 
the law is consistent with the law referred to in subparagraph (A) 
or (B). 
(3) APPROPRIATE FEDERAL ENTITIES.—The term ‘‘appropriate fed-
eral entities’’ means the following: 
(A) The Department of Commerce. 
(B) The Department of Defense. 
(C) The Department of Energy. 
(D) The Department of Homeland Security. 
(E) The Department of Justice. 
(F) The Department of the Treasury. 
(4) CYBERSECURITY PURPOSE.—The term ‘‘cybersecurity purpose’’ 
means the purpose of protecting an information system or information 
that is stored on, processed by, or transiting an information system 
from a cybersecurity threat or security vulnerability. 
(5) CYBERSECURITY THREAT.— 
(A) IN GENERAL.—Except as provided in subparagraph (B), the 
term ‘‘cybersecurity threat’’ means an action, not protected by the 
1st amendment of the Constitution, on or through an information 
system that may result in an unauthorized effort to adversely im-
pact the security, availability, confidentiality, or integrity of an in-
formation system or information that is stored on, processed in, 
or transiting an information system. 
(B) EXCLUSION.—The term ‘‘cybersecurity threat’’ does not in-
clude any action that solely involves a violation of a consumer 
term of service or a consumer licensing agreement. 
(6) CYBER THREAT INDICATOR.—The term ‘‘cyber threat indicator’’ 
means information that is necessary to describe or identify— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00125
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
126 
(A) malicious reconnaissance, including anomalous patterns of 
communication that appear to be transmitted for the purpose of 
gathering technical information relating to a cybersecurity threat 
or security vulnerability; 
(B) a method of defeating a security control or exploitation of 
a security vulnerability; 
(C) a security vulnerability, including anomalous activity that 
appears to indicate the existence of a security vulnerability; 
(D) a method of causing a user with legitimate access to an in-
formation system or information that is stored on, processed by, 
or transiting an information system to unwittingly enable the de-
feat of a security control or exploitation of a security vulnerability; 
(E) malicious cyber command and control; 
(F) the actual or potential harm caused by an incident, includ-
ing a description of the information exfiltrated as a result of a 
particular cybersecurity threat; 
(G) any other attribute of a cybersecurity threat, if disclosure 
of the attribute is not otherwise prohibited by law; or 
(H) any combination of subparagraphs (A) through (G). 
(7) DEFENSIVE MEASURE.— 
(A) IN GENERAL.—Except as provided in subparagraph (B), the 
term ‘‘defensive measure’’ means an action, device, procedure, sig-
nature, technique, or other measure applied to an information sys-
tem or information that is stored on, processed by, or transiting 
an information system that detects, prevents, or mitigates a known 
or suspected cybersecurity threat or security vulnerability. 
(B) EXCLUSION.—The term ‘‘defensive measure’’ does not in-
clude a measure that destroys, renders unusable, provides unau-
thorized access to, or substantially harms an information system 
or information stored on, processed by, or transiting the informa-
tion system not owned by— 
(i) the private entity operating the measure; or 
(ii) another entity or Federal entity that may provide con-
sent and has provided consent to that private entity for oper-
ation of the measure. 
(8) FEDERAL ENTITY.—The term ‘‘Federal entity’’ means a depart-
ment or agency of the United States or any component of the depart-
ment or agency. 
(9) INFORMATION SYSTEM.—The term ‘‘information system’’— 
(A) has the meaning given the term in section 3502 of title 44; 
and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00126
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
127 
(B) includes industrial control systems such as supervisory con-
trol and data acquisition systems, distributed control systems, and 
programmable logic controllers. 
(10) LOCAL GOVERNMENT.—The term ‘‘local government’’ means 
any borough, city, county, parish, town, township, village or other polit-
ical subdivision of a State. 
(11) MALICIOUS CYBER COMMAND AND CONTROL.—The term ‘‘mali-
cious cyber command and control’’ means a method for unauthorized 
remote identification of, access to, or use of, an information system or 
information that is stored on, processed by, or transiting an informa-
tion system. 
(12) MALICIOUS RECONNAISSANCE.—The term ‘‘malicious reconnais-
sance’’ means a method for actively probing or passively monitoring an 
information system for the purpose of discerning security vulnerabilities 
of the information system, if the method is associated with a known 
or suspected cybersecurity threat. 
(13) MONITOR.—The term ‘‘monitor’’ means to acquire, identify, or 
scan, or to possess, information that is stored on, processed by, or 
transiting an information system. 
(14) NON-FEDERAL ENTITY.— 
(A) IN GENERAL.—Except as provided in this paragraph, the 
term ‘‘non-Federal entity’’ means any private entity, non-Federal 
Government agency or department, or State, tribal, or local gov-
ernment (including a political subdivision, department, or compo-
nent of the government). 
(B) INCLUSIONS.—The term ‘‘non-Federal entity’’ includes a 
government agency or department of the District of Columbia, 
Puerto Rico, the Virgin Islands, Guam, American Samoa, the 
Northern Mariana Islands, and any other territory or possession 
of the United States. 
(C) EXCLUSIONS.—The term ‘‘non-Federal entity’’ does not in-
clude a foreign power as defined in section 101 of the Foreign In-
telligence Surveillance Act of 1978 (50 U.S.C. 1801). 
(15) PRIVATE ENTITY.— 
(A) IN GENERAL.—Except as provided in this paragraph, the 
term ‘‘private entity’’ means any person or private group, organi-
zation, proprietorship, partnership, trust, cooperative organization, 
or other commercial or nonprofit entity, including an officer, em-
ployee, or agent. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00127
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
128 
(B) INCLUSION.—The term ‘‘private entity’’ includes a State, 
tribal, or local government performing utility services, such as 
electric, natural gas, or water services. 
(C) EXCLUSION.—The term ‘‘private entity’’ does not include a 
foreign power as defined in section 101 of the Foreign Intelligence 
Surveillance Act of 1978 (50 U.S.C. 1801). 
(16) SECURITY CONTROL.—The term ‘‘security control’’ means the 
management, operational, and technical controls used to protect 
against an unauthorized effort to adversely affect the confidentiality, 
integrity, and availability of an information system or its information. 
(17) SECURITY VULNERABILITY.–The term ‘‘security vulnerability’’ 
means any attribute of hardware, software, process, or procedure that 
could enable or facilitate the defeat of a security control. 
(18) TRIBAL.—The term ‘‘tribal’’ has the meaning given the term 
‘‘Indian tribe’’ in section 4 of the Indian Self-Determination and Edu-
cation Assistance Act (25 U.S.C. 450b). 
§ 10562. Procedures for sharing information by Federal Gov-
ernment 
(a) IN GENERAL.—Consistent with the protection of classified informa-
tion, intelligence sources and methods, and privacy and civil liberties, the 
Director of National Intelligence, the Secretary of Homeland Security, the 
Secretary of Defense, and the Attorney General, in consultation with the 
heads of the appropriate Federal entities, shall jointly develop and issue pro-
cedures to facilitate and promote— 
(1) timely sharing of classified cyber threat indicators and defensive 
measures the Federal Government possesses with representatives of rel-
evant Federal entities and non-Federal entities that have appropriate 
security clearances; 
(2) timely sharing with relevant Federal entities and non-Federal en-
tities of cyber threat indicators, defensive measures, and information 
relating to cybersecurity threats or authorized uses under this part, in 
the possession of the Federal Government, that may be declassified and 
shared at an unclassified level; 
(3) timely sharing with relevant Federal entities and non-Federal en-
tities, or the public if appropriate, of unclassified, including controlled 
unclassified, cyber threat indicators and defensive measures the Fed-
eral Government possesses; 
(4) timely sharing with Federal entities and non-Federal entities, if 
appropriate, of information relating to cybersecurity threats or author-
ized uses under this part that the Federal Government possesses about 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00128
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
129 
cybersecurity threats to those entities to prevent or mitigate adverse ef-
fects from the threats; and 
(5) periodic sharing, through publication and targeted outreach, of 
cybersecurity best practices that are developed based on ongoing anal-
yses of cyber threat indicators, defensive measures, and information re-
lating to cybersecurity threats or authorized uses under this part, in 
the possession of the Federal Government with attention to accessibility 
and implementation challenges faced by small business concerns (as de-
fined in section 3 of the Small Business Act (15 U.S.C. 632)). 
(b) CONTENT.—The procedures developed under subsection (a) shall— 
(1) ensure the Federal Government has and maintains the capability 
to share cyber threat indicators and defensive measures in real time 
consistent with the protection of classified information; 
(2) incorporate to the greatest extent practicable existing processes 
and existing roles and responsibilities of Federal entities and non-Fed-
eral entities for information sharing by the Federal Government, in-
cluding sector specific information sharing and analysis centers; 
(3) include procedures for notifying, in a timely manner, Federal en-
tities and non-Federal entities that have received a cyber threat indi-
cator or defensive measure from a Federal entity under this part that 
is known or determined to be in error or in contravention of the re-
quirements of this part or another provision of Federal law or policy 
of the error or contravention; 
(4) include requirements for Federal entities sharing cyber threat in-
dicators or defensive measures to implement and utilize security con-
trols to protect against unauthorized access to, or acquisition of, the 
indicators or measures; 
(5) include procedures that require a Federal entity, prior to the 
sharing of a cyber threat indicator— 
(A) to— 
(i) review the indicator to assess whether the indicator con-
tains any information not directly related to a cybersecurity 
threat that the Federal entity knows at the time of sharing 
to be personal information of a specific individual or informa-
tion that identifies a specific individual; and 
(ii) remove the information; or 
(B) to implement and utilize a technical capability configured to 
remove information not directly related to a cybersecurity threat 
that the Federal entity knows at the time of sharing to be per-
sonal information of a specific individual or information that iden-
tifies a specific individual; and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00129
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
130 
(6) include procedures for notifying, in a timely manner, any United 
States person whose personal information is known or determined to 
have been shared by a Federal entity in violation of this part. 
(c) CONSULTATION.—In developing the procedures required under this 
section, the Director of National Intelligence, the Secretary, the Secretary 
of Defense, and the Attorney General shall consult with appropriate Federal 
entities, including the Small Business Administration and the National Lab-
oratories (as defined in section 2 of the Energy Policy Act of 2005 (42 
U.S.C. 15801)), to ensure that effective protocols are implemented that will 
facilitate and promote the sharing of cyber threat indicators by the Federal 
Government in a timely manner. 
(d) SUBMITTAL TO CONGRESS.—The Director of National Intelligence, in 
consultation with the heads of the appropriate Federal entities, shall submit 
to Congress the procedures required by subsection (a). 
§ 10563. Authorization for preventing, detecting, analyzing, 
and mitigating cybersecurity threats. 
(a) AUTHORIZATION FOR MONITORING.— 
(1) IN GENERAL.—A private entity may, for cybersecurity purposes, 
monitor— 
(A) an information system of the private entity; 
(B) an information system of another non-Federal entity, on the 
authorization and written consent of the other entity; 
(C) an information system of a Federal entity, on the authoriza-
tion and written consent of an authorized representative of the 
Federal entity; and 
(D) information that is stored on, processed by, or transiting an 
information system monitored by the private entity under this 
paragraph. 
(2) CONSTRUCTION.—Nothing in paragraph (1) shall be construed 
to— 
(A) authorize the monitoring of an information system, or the 
use of information obtained through the monitoring, other than as 
provided in this part; or 
(B) limit otherwise lawful activity. 
(b) AUTHORIZATION FOR OPERATION OF DEFENSIVE MEASURES.— 
(1) IN GENERAL.—A private entity may, for cybersecurity purposes, 
operate a defensive measure that is applied to— 
(A) an information system of the private entity to protect the 
rights or property of the entity; 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00130
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
131 
(B) an information system of another non-Federal entity, on 
written consent of the other entity for operation of the defensive 
measure to protect the rights or property of the entity; 
(C) an information system of a Federal entity on written con-
sent of an authorized representative of the Federal entity for oper-
ation of the defensive measure to protect the rights or property 
of the Federal Government. 
(2) CONSTRUCTION.—Nothing in paragraph (1) shall be construed 
to— 
(A) authorize the use of a defensive measure other than as pro-
vided in paragraph (1); or 
(B) limit otherwise lawful activity. 
(c) AUTHORIZATION FOR SHARING OR RECEIVING CYBER THREAT INDI-
CATORS OR DEFENSIVE MEASURES.— 
(1) IN GENERAL.—Except as provided in paragraph (2), a non-Fed-
eral entity may, for a cybersecurity purpose and consistent with the 
protection of classified information, share with, or receive, from, any 
other non-Federal entity or the Federal Government a cyber threat in-
dicator or defensive measure. 
(2) COMPLIANCE WITH LAWFUL RESTRICTION.—A non-Federal enti-
ty receiving a cyber threat indicator or defensive measure from another 
non-Federal entity or a Federal entity shall comply with otherwise law-
ful restrictions placed on the sharing or use of the indicator or defen-
sive measure by the sharing non-Federal entity or Federal entity. 
(3) CONSTRUCTION.—Nothing in paragraph (1) shall be construed 
to— 
(A) authorize the sharing or receiving of a cyber threat indi-
cator or defensive measure other than as provided in paragraph 
(1); or 
(B) limit otherwise lawful activity. 
(d) PROTECTION AND USE OF INFORMATION.— 
(1) SECURITY OF INFORMATION.—A non-Federal entity monitoring 
an information system, operating a defensive measure, or providing or 
receiving a cyber threat indicator or defensive measure under this sec-
tion shall implement and utilize a security control to protect against 
unauthorized access to or acquisition of the cyber threat indicator or 
defensive measure. 
(2) REMOVAL OF CERTAIN PERSONAL INFORMATION.—A non-Fed-
eral entity sharing a cyber threat indicator pursuant to this part shall, 
prior to sharing— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00131
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
132 
(A) review the cyber threat indicator to assess whether the indi-
cator contains any information not directly related to a cybersecu-
rity threat that the non-Federal entity knows at the time of shar-
ing to be personal information of a specific individual or informa-
tion that identifies a specific individual and remove the informa-
tion; or 
(B) implement and utilize a technical capability configured to 
remove any information not directly related to a cybersecurity 
threat that the non-Federal entity knows at the time of sharing 
to be personal information of a specific individual or information 
that identifies a specific individual. 
(3) USE OF CYBER THREAT INDICATORS AND DEFENSIVE MEASURES 
BY NON-FEDERAL ENTITIES.— 
(A) IN GENERAL.—Consistent with this part, a cyber threat in-
dicator or defensive measure shared or received under this section 
may, for cybersecurity purposes— 
(i) be used by a non-Federal entity to monitor or operate 
a defensive measure that is applied to— 
(I) an information system of the non-Federal entity; 
or 
(II) an information system of another non-Federal en-
tity or a Federal entity on the written consent of the 
other non-Federal entity or that Federal entity; and 
(ii) be otherwise used, retained, and further shared by a 
non-Federal entity subject to— 
(I) an otherwise lawful restriction placed by the shar-
ing non-Federal entity or Federal entity on the cyber 
threat indicator or defensive measure; or 
(II) an otherwise applicable provision of law. 
(B) CONSTRUCTION.—Nothing in subparagraph (A) shall be 
construed to authorize the use of a cyber threat indicator or defen-
sive measure other than as provided in this section. 
(4) USE OF CYBER THREAT INDICATORS BY STATE, TRIBAL, OR 
LOCAL GOVERNMENT.— 
(A) LAW ENFORCEMENT USE.—A State, tribal, or local govern-
ment that receives a cyber threat indicator or defensive measure 
under this part may use the cyber threat indicator or defensive 
measure for the purposes described in section 10564(e)(5)(A) of 
this title. 
(B) EXEMPTION FROM DISCLOSURE.—A cyber threat indicator 
or defensive measure shared by or with a State, tribal, or local 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00132
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
133 
government, including a component of a State, tribal, or local gov-
ernment that is a private entity, under this section shall be— 
(i) considered voluntarily shared information; and 
(ii) exempt from disclosure under any provision of State, 
tribal, or local freedom of information law, open government 
law, open meetings law, open records law, sunshine law, or 
similar law requiring disclosure of information or records. 
(C) STATE, TRIBAL, AND LOCAL REGULATORY AUTHORITY.— 
(i) IN GENERAL.—Except as provided in clause (ii), a cyber 
threat indicator or defensive measure shared with a State, 
tribal, or local government under this part shall not be used 
by any State, tribal, or local government to regulate, includ-
ing an enforcement action, the lawful activity of any non-Fed-
eral entity or any activity taken by a non-Federal entity pur-
suant to mandatory standards, including an activity relating 
to monitoring, operating a defensive measure, or sharing a 
cyber threat indicator. 
(ii) REGULATORY AUTHORITY SPECIFICALLY RELATING TO 
PREVENTION
OR
MITIGATION
OF
CYBERSECURITY 
THREATS.—A cyber threat indicator or defensive measure 
shared as described in clause (i) may, consistent with a State, 
tribal, or local government regulatory authority specifically re-
lating to the prevention or mitigation of cybersecurity threats 
to information systems, inform the development or implemen-
tation of a regulation relating to the information systems. 
(e) ANTITRUST EXEMPTION.— 
(1) IN GENERAL.—Except as provided in section 10569(e) of this 
title, it shall not be considered a violation of any provision of antitrust 
laws for 2 or more private entities to exchange or provide a cyber 
threat indicator or defensive measure, or assistance, relating to the pre-
vention, investigation, or mitigation of a cybersecurity threat, for cyber-
security purposes under this part. 
(2) APPLICABILITY.—Paragraph (1) shall apply only to information 
that is exchanged or assistance provided to assist with— 
(A) facilitating the prevention, investigation, or mitigation of a 
cybersecurity threat to an information system or information that 
is stored on, processed by, or transiting an information system; or 
(B) communicating or disclosing a cyber threat indicator to help 
prevent, investigate, or mitigate the effect of a cybersecurity threat 
to an information system or information that is stored on, proc-
essed by, or transiting an information system. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00133
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
134 
(f) NO RIGHT OR BENEFIT.—The sharing of a cyber threat indicator or 
defensive measure with a non-Federal entity under this part shall not create 
a right or benefit to similar information by the non-Federal entity or any 
other non-Federal entity. 
§ 10564. Sharing of cyber threat indicators and defensive 
measures with Federal Government 
(a) DEVELOPMENT OF POLICIES AND PROCEDURES.—The Attorney Gen-
eral and the Secretary shall, in consultation with the heads of the appro-
priate Federal entities, jointly issue and make publicly available policies and 
procedures relating to the receipt of cyber threat indicators and defensive 
measures by the Federal Government. Consistent with the guidelines re-
quired by subsection (d), the policies and procedures shall ensure— 
(1) that cyber threat indicators shared with the Federal Government 
by any non-Federal entity pursuant to section 10563(c) of this title 
through the real-time process described in subsection (d)— 
(A) are shared in an automated manner with all appropriate 
Federal entities; 
(B) are only subject to a delay, modification, or other action due 
to controls established for the real-time process that could impede 
real-time receipt by all appropriate Federal entities when the 
delay, modification, or other action is due to controls— 
(i) agreed on unanimously by all of the heads of the appro-
priate Federal entities; 
(ii) carried out before any appropriate Federal entity re-
tains or uses the cyber threat indicators or defensive meas-
ures; and 
(iii) uniformly applied so that each appropriate Federal en-
tity is subject to the same delay, modification, or other ac-
tion; and 
(C) may be provided to other Federal entities; 
(2) that cyber threat indicators shared with the Federal Government 
by any non-Federal entity pursuant to section 10563 of this title in a 
manner other than the real-time process described in subsection (d)— 
(A) are shared as quickly as operationally practicable with all 
appropriate Federal entities; 
(B) are not subject to any unnecessary delay, interference, or 
any other action that could impede receipt by all appropriate Fed-
eral entities; and 
(C) may be provided to other Federal entities; and 
(3) there are— 
(A) audit capabilities; and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00134
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
135 
(B) appropriate sanctions in place for officers, employees, or 
agents of a Federal entity who knowingly and willfully conduct ac-
tivities under this part in an unauthorized manner. 
(b) GUIDELINES FOR ENTITIES SHARING CYBER THREAT INDICATORS 
WITH FEDERAL GOVERNMENT.—The Attorney General and the Secretary 
jointly shall develop and make publicly available guidance to assist entities 
and promote sharing of cyber threat indicators with Federal entities under 
this part. The guidelines shall include guidance on the following: 
(1) Identification of types of information that would qualify as a 
cyber threat indicator under this part that would be unlikely to include 
information that— 
(A) is not directly related to a cybersecurity threat; and 
(B) is personal information of a specific individual or informa-
tion that identifies a specific individual. 
(2) Identification of types of information protected under otherwise 
applicable privacy laws that are unlikely to be directly related to a cy-
bersecurity threat. 
(3) Such other matters as the Attorney General and the Secretary 
consider appropriate for entities sharing cyber threat indicators with 
Federal entities under this part. 
(c) PRIVACY AND CIVIL LIBERTIES.— 
(1) ISSUANCE AND AVAILABILITY OF GUIDELINES.—The Attorney 
General and the Secretary shall, in coordination with the heads of the 
appropriate Federal entities and in consultation with officers des-
ignated undersection 1062 of the Intelligence Reform and Terrorism 
Prevention Act of 2004 (42 U.S.C. 2000ee–1) and such private entities 
with industry expertise as the Attorney General and the Secretary con-
sider relevant, jointly issue and make publicly available final guidelines 
relating to privacy and civil liberties that shall govern the receipt, re-
tention, use, and dissemination of cyber threat indicators by a Federal 
entity obtained in connection with activities authorized in this part. 
(2) CONTENT.—The guidelines shall, consistent with the need to pro-
tect information systems from cybersecurity threats and mitigate cyber-
security threats— 
(A) limit the effect on privacy and civil liberties of activities by 
the Federal Government under this part; 
(B) limit the receipt, retention, use, and dissemination of cyber 
threat indicators containing personal information of specific indi-
viduals or information that identifies specific individuals, including 
by establishing— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00135
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
136 
(i) a process for the timely destruction of the information 
that is known not to be directly related to uses authorized 
under this part; and 
(ii) specific limitations on the length of any period in which 
a cyber threat indicator may be retained; 
(C) include requirements to safeguard cyber threat indicators 
containing personal information of specific individuals or informa-
tion that identifies specific individuals from unauthorized access or 
acquisition, including appropriate sanctions for activities by offi-
cers, employees, or agents of the Federal Government in con-
travention of the guidelines; 
(D) consistent with this part, any other applicable provisions of 
law, and the fair information practice principles set forth in ap-
pendix A of the document entitled ‘‘National Strategy for Trusted 
Identities in Cyberspace’’ and published by the President in April 
2011, govern the retention, use, and dissemination by the Federal 
Government of cyber threat indicators shared with the Federal 
Government under this part, including the extent to which the 
cyber threat indicators may be used by the Federal Government; 
(E) include procedures for notifying entities and Federal enti-
ties if information received pursuant to this section is known or 
determined by a Federal entity receiving the information not to 
constitute a cyber threat indicator; 
(F) protect the confidentiality of cyber threat indicators con-
taining personal information of specific individuals or information 
that identifies specific individuals to the greatest extent practicable 
and require recipients to be informed that the indicators may only 
be used for purposes authorized under this part; and 
(G) include steps that may be needed so that dissemination of 
cyber threat indicators is consistent with the protection of classi-
fied and other sensitive national security information. 
(3) PERIODIC REVIEW.—The Attorney General and the Secretary 
shall, in coordination with the heads of the appropriate Federal entities 
and in consultation with officers and private entities described in para-
graph (1), periodically, but not less frequently than once every 2 years, 
jointly review the guidelines issued under paragraph (1). 
(d) CAPABILITY AND PROCESS IN THE DEPARTMENT.— 
(1) IN GENERAL.—The Secretary, in coordination with the heads of 
the appropriate Federal entities, shall develop and implement a capa-
bility and process in the Department that— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00136
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
137 
(A) shall accept from any non-Federal entity in real time cyber 
threat indicators and defensive measures, pursuant to this section; 
(B) on submittal of the certification under paragraph (2) that 
the capability and process fully and effectively operates as de-
scribed in paragraph (2), shall be the process by which the Fed-
eral Government receives cyber threat indicators and +defensive 
measures under this part that are shared by a non-Federal entity 
with the Federal Government through electronic mail or media, an 
interactive form on an Internet website, or a real time, automated 
process between information systems, except— 
(i) consistent with section 10563 of this title, communica-
tions between a Federal entity and a non-Federal entity re-
garding a previously shared cyber threat indicator to— 
(I) describe the relevant cybersecurity threat; or 
(II) develop a defensive measure based on the cyber 
threat indicator; and 
(ii) communications by a regulated non-Federal entity with 
the entity’s Federal regulatory authority regarding a cyberse-
curity threat; 
(C) ensures that all of the appropriate Federal entities receive 
in an automated manner cyber threat indicators and defensive 
measures shared through the real-time process in the Department; 
(D) is in compliance with the policies, procedures, and guide-
lines required by this section; and 
(E) does not limit or prohibit otherwise lawful disclosures of 
communications, records, or other information, including— 
(i) reporting known or suspected criminal activity, by a 
non-Federal entity to any other non-Federal entity or a Fed-
eral entity, including cyber threat indicators or defensive 
measures shared with a Federal entity in furtherance of open-
ing a Federal law enforcement investigation; 
(ii) voluntary or legally compelled participation in a Fed-
eral investigation; and 
(iii) providing cyber threat indicators or defensive measures 
as part of a statutory or authorized contractual requirement. 
(2) CERTIFICATION AND DESIGNATION.— 
(A) CERTIFICATION OF CAPABILITY AND PROCESS.—The Sec-
retary shall, in consultation with the heads of the appropriate Fed-
eral entities, submit to Congress a certification as to whether the 
capability and process required by paragraph (1) fully and effec-
tively operates— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00137
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
138 
(i) as the process by which the Federal Government re-
ceives from any non-Federal entity a cyber threat indicator 
or defensive measure under this part; and 
(ii) in accordance with the interim policies, procedures, and 
guidelines developed under this part. 
(B) DESIGNATION.— 
(i) IN GENERAL.—At any time after certification is sub-
mitted under subparagraph (A), the President may designate 
an appropriate Federal entity, other than the Department of 
Defense (including the National Security Agency), to develop 
and implement a capability and process as described in para-
graph (1) in addition to the capability and process developed 
under paragraph (1) by the Secretary, if, not fewer than 30 
days before making the designation, the President submits to 
Congress a certification and explanation that— 
(I) the designation is necessary to ensure full, effec-
tive, and secure operation of a capability and process for 
the Federal Government to receive from any non-Federal 
entity cyber threat indicators or defensive measures 
under this part; 
(II) the designated appropriate Federal entity will re-
ceive and share cyber threat indicators and defensive 
measures in accordance with the policies, procedures, 
and guidelines developed under this part, including sub-
section (a)(1); and 
(III) the designation is consistent with the mission of 
the appropriate Federal entity and improves the ability 
of the Federal Government to receive, share, and use 
cyber threat indicators and defensive measures as au-
thorized under this part. 
(ii) APPLICATION TO ADDITIONAL CAPABILITY AND PROC-
ESS.—If the President designates an appropriate Federal en-
tity to develop and implement a capability and process under 
clause (i), the provisions of this part that apply to the capa-
bility and process required by paragraph (1) apply to the ca-
pability and process developed and implemented under clause 
(i). 
(3) PUBLIC NOTICE AND ACCESS.—The Secretary shall ensure there 
is public notice of, and access to, the capability and process developed 
and implemented under paragraph (1) so that— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00138
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
139 
(A) any non-Federal entity may share cyber threat indicators 
and defensive measures through the process with the Federal Gov-
ernment; and 
(B) all of the appropriate Federal entities receive the cyber 
threat indicators and defensive measures in real time with receipt 
through the process in the Department consistent with the policies 
and procedures issued under subsection (a). 
(4) OTHER FEDERAL ENTITIES.—The process developed and imple-
mented under paragraph (1) shall ensure that other Federal entities re-
ceive in a timely manner any cyber threat indicators and defensive 
measures shared with the Federal Government through the process. 
(e) INFORMATION SHARED WITH OR PROVIDED TO FEDERAL GOVERN-
MENT.— 
(1) NO WAIVER OF PRIVILEGE OR PROTECTION.—The provision of 
cyber threat indicators and defensive measures to the Federal Govern-
ment under this part shall not constitute a waiver of any applicable 
privilege or protection provided by law, including trade secret protec-
tion. 
(2) 
PROPRIETARY
INFORMATION.—Consistent 
with 
section 
10563(c)(2) of this title and any other applicable provision of law, a 
cyber threat indicator or defensive measure provided by a non-Federal 
entity to the Federal Government under this part shall be considered 
the commercial, financial, and proprietary information of the non-Fed-
eral entity when so designated by the originating non-Federal entity or 
a 3d party acting in accordance with the written authorization of the 
originating non-Federal entity. 
(3) EXEMPTION FROM DISCLOSURE.—A cyber threat indicator or de-
fensive measure shared with the Federal Government under this part 
shall be— 
(A) deemed voluntarily shared information and exempt from dis-
closure under section 552 of title 5 and any State, tribal, or local 
provision of law requiring disclosure of information or records; and 
(B) withheld, without discretion, from the public under section 
552(b)(3)(B) of title 5 and any State, tribal, or local provision of 
law requiring disclosure of information or records. 
(4) EX PARTE COMMUNICATIONS.—The provision of a cyber threat 
indicator or defensive measure to the Federal Government under this 
part shall not be subject to a rule of any Federal agency or department 
or any judicial doctrine regarding ex parte communications with a deci-
sion-making official. 
(5) DISCLOSURE, RETENTION, AND USE.— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00139
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
140 
(A) AUTHORIZED ACTIVITIES.—Cyber threat indicators and de-
fensive measures provided to the Federal Government under this 
part may, consistent with otherwise applicable provisions of Fed-
eral law, be disclosed to, retained by, and used by any Federal 
agency or department, component, officer, employee, or agent of 
the Federal Government solely for— 
(i) a cybersecurity purpose; 
(ii) the purpose of identifying— 
(I) a cybersecurity threat, including the source of the 
cybersecurity threat; or 
(II) a security vulnerability; 
(iii) the purpose of responding to, or otherwise preventing 
or mitigating, a specific threat of death, a specific threat of 
serious bodily harm, or a specific threat of serious economic 
harm, including a terrorist act or a use of a weapon of mass 
destruction; 
(iv) the purpose of responding to, investigating, pros-
ecuting, or otherwise preventing or mitigating, a serious 
threat to a minor, including sexual exploitation and threats 
to physical safety; or 
(v) the purpose of preventing, investigating, disrupting, or 
prosecuting an offense arising out of a threat described in 
clause (iii) or any of the offenses listed in sections 1028 
through 1030 and chapters 37 and 90 of title 18. 
(B) PROHIBITED ACTIVITIES.—Cyber threat indicators and de-
fensive measures provided to the Federal Government under this 
part shall not be disclosed to, retained by, or used by any Federal 
agency or department for any use not permitted under subpara-
graph (A). 
(C) PRIVACY AND CIVIL LIBERTIES.—Cyber threat indicators 
and defensive measures provided to the Federal Government under 
this part shall be retained, used, and disseminated by the Federal 
Government— 
(i) in accordance with the policies, procedures, and guide-
lines required by subsections (a) through (c); 
(ii) in a manner that protects from unauthorized use or 
disclosure any cyber threat indicators that may contain— 
(I) personal information of a specific individual; or 
(II) information that identifies a specific individual; 
and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00140
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
141 
(iii) in a manner that protects the confidentiality of cyber 
threat indicators containing— 
(I) personal information of a specific individual; or 
(II) information that identifies a specific individual. 
(D) FEDERAL REGULATORY AUTHORITY.— 
(i) IN GENERAL.—Except as provided in clause (ii), cyber 
threat indicators and defensive measures provided to the Fed-
eral Government under this part shall not be used by any 
Federal, State, tribal, or local government to regulate, includ-
ing an enforcement action, the lawful activities of any non- 
Federal entity or any activities taken by a non-Federal entity 
pursuant to mandatory standards, including activities relating 
to monitoring, operating defensive measures, or sharing cyber 
threat indicators. 
(ii) EXCEPTIONS.— 
(I) REGULATORY AUTHORITY SPECIFICALLY RELATING 
TO
PREVENTION
OR
MITIGATION
OF
CYBERSECURITY 
THREATS.—Cyber threat indicators and defensive meas-
ures provided to the Federal Government under this part 
may, consistent with Federal or State regulatory author-
ity specifically relating to the prevention or mitigation of 
cybersecurity threats to information systems, inform the 
development or implementation of regulations relating to 
the information systems. 
(II) PROCEDURES
DEVELOPED
AND
IMPLEMENTED 
UNDER THIS PART.—Clause (i) shall not apply to proce-
dures developed and implemented under this part. 
§ 10565. Protection from liability 
(a) MONITORING OF INFORMATION SYSTEMS.—No cause of action shall 
be brought in any court against any private entity, and the action shall be 
promptly dismissed, for the monitoring of an information system and infor-
mation under section 10563(a) of this title that is conducted in accordance 
with this part. 
(b) SHARING OR RECEIPT OF CYBER THREAT INDICATORS.—No cause of 
action shall be brought in any court against any private entity, and the ac-
tion shall be promptly dismissed, for the sharing or receipt of a cyber threat 
indicator or defensive measure under section 10563(c) of this title if— 
(1) the sharing or receipt is conducted in accordance with this part; 
and 
(2) in a case in which a cyber threat indicator or defensive measure 
is shared with the Federal Government, the cyber threat indicator or 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00141
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
142 
defensive measure is shared in a manner that is consistent with section 
10564(d)(1)(B) of this title. 
(c) CONSTRUCTION.—Nothing in this part shall be construed— 
(1) to create— 
(A) a duty to share a cyber threat indicator or defensive meas-
ure; or 
(B) a duty to warn or act based on the receipt of a cyber threat 
indicator or defensive measure; or 
(2) to undermine or limit the availability of otherwise applicable com-
mon law or statutory defenses. 
§ 10566. Oversight of Government activities 
(a) REPORT ON IMPLEMENTATION.—Not later than December 18, 2016, 
the heads of the appropriate Federal entities shall jointly submit to Con-
gress a detailed report concerning the implementation of this part. The re-
port may include such recommendations as the heads of the appropriate 
Federal entities may have for improvements or modifications to the authori-
ties, policies, procedures, and guidelines under this part and shall include 
the following: 
(1) An evaluation of the effectiveness of real-time information shar-
ing through the capability and process developed under section 
10564(d) of this title, including any impediments to real-time sharing. 
(2) An assessment of whether cyber threat indicators or defensive 
measures have been properly classified and an accounting of the num-
ber of security clearances authorized by the Federal Government for 
sharing cyber threat indicators or defensive measures with the private 
sector. 
(3) The number of cyber threat indicators or defensive measures re-
ceived through the capability and process developed under section 
10564(d) of this title. 
(4) A list of Federal entities that have received cyber threat indica-
tors or defensive measures under this part. 
(b) BIENNIAL REPORT ON COMPLIANCE.— 
(1) WHEN REPORT SHALL BE SUBMITTED.—Not later than Decem-
ber 18, 2017, and not less frequently than once every 2 years there-
after, the inspectors general of the appropriate Federal entities, in con-
sultation with the Inspector General of the Intelligence Community and 
the Council of Inspectors General on Financial Oversight, shall jointly 
submit to Congress an interagency report on the actions of the execu-
tive branch of the Federal Government to carry out this part during 
the most recent 2-year period. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00142
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
143 
(2) CONTENTS.—Each report shall include, for the period covered by 
the report, the following: 
(A) An assessment of the sufficiency of the policies, procedures, 
and guidelines relating to the sharing of cyber threat indicators in 
the Federal Government, including those policies, procedures, and 
guidelines relating to the removal of information not directly re-
lated to a cybersecurity threat that is personal information of a 
specific individual or information that identifies a specific indi-
vidual. 
(B) An assessment of whether cyber threat indicators or defen-
sive measures have been properly classified and an accounting of 
the number of security clearances authorized by the Federal Gov-
ernment for the purpose of sharing cyber threat indicators or de-
fensive measures with the private sector. 
(C) A review of the actions taken by the Federal Government 
based on cyber threat indicators or defensive measures shared with 
the Federal Government under this part, including a review of the 
following: 
(i) The appropriateness of subsequent uses and dissemina-
tions of cyber threat indicators or defensive measures. 
(ii) Whether cyber threat indicators or defensive measures 
were shared in a timely and adequate manner with appro-
priate entities, or, if appropriate, were made publicly avail-
able. 
(D) An assessment of the cyber threat indicators or defensive 
measures shared with the appropriate Federal entities under this 
part, including the following: 
(i) The number of cyber threat indicators or defensive 
measures shared through the capability and process developed 
under section 10564(d) of this title. 
(ii) An assessment of any information not directly related 
to a cybersecurity threat that is personal information of a 
specific individual or information identifying a specific indi-
vidual and was shared by a non-Federal government entity 
with the Federal Government in contravention of this part, or 
was shared in the Federal Government in contravention of 
the guidelines required by this part, including a description 
of any significant violation of this part. 
(iii) The number of times, according to the Attorney Gen-
eral, that information shared under this part was used by a 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00143
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
144 
Federal entity to prosecute an offense listed in section 
10564(e)(5)(A) of this title. 
(iv) A quantitative and qualitative assessment of the effect 
of the sharing of cyber threat indicators or defensive meas-
ures with the Federal Government on the privacy and civil 
liberties of specific individuals, including the number of no-
tices that were issued with respect to a failure to remove in-
formation not directly related to a cybersecurity threat that 
was personal information of a specific individual or informa-
tion that identified a specific individual in accordance with 
the procedures required by section 10564(c)(2)(E) of this 
title. 
(v) The adequacy of any steps taken by the Federal Gov-
ernment to reduce any adverse effect from activities carried 
out under this part on the privacy and civil liberties of United 
States persons. 
(E) An assessment of the sharing of cyber threat indicators or 
defensive measures among Federal entities to identify inappro-
priate barriers to sharing information. 
(3) RECOMMENDATIONS.—Each report may include such rec-
ommendations as the inspectors general may have for improvements or 
modifications to the authorities and processes under this part. 
(c) INDEPENDENT REPORT ON REMOVAL OF PERSONAL INFORMATION.— 
Not later than December 18, 2018, the Comptroller General shall submit 
to Congress a report on the actions taken by the Federal Government to 
remove personal information from cyber threat indicators or defensive meas-
ures pursuant to this part. The report shall include an assessment of the 
sufficiency of the policies, procedures, and guidelines established under this 
part in addressing concerns relating to privacy and civil liberties. 
(d) FORM OF REPORTS.—Each report required under this section shall 
be submitted in an unclassified form, but may include a classified annex. 
(e) PUBLIC AVAILABILITY OF REPORTS.—The unclassified portions of the 
reports required under this section shall be made available to the public. 
§ 10567. Report on cybersecurity threats 
(a) DEFINITION OF INTELLIGENCE COMMUNITY.—In this section, the 
term ‘‘intelligence community’’ has the meaning given that term in section 
3 of the National Security Act of 1947 (50 U.S.C. 3003). 
(b) WHEN REPORT SHALL BE SUBMITTED.—Not later than 180 days 
after December 18, 2015, the Director of National Intelligence, in coordina-
tion with the heads of other appropriate elements of the intelligence commu-
nity, shall submit to the Select Committee on Intelligence of the Senate and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00144
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
145 
the Permanent Select Committee on Intelligence of the House of Represent-
atives a report on cybersecurity threats, including cyberattacks, theft, and 
data breaches. 
(c) CONTENTS.—The report shall include the following: 
(1) An assessment of the current intelligence sharing and coopera-
tion relationships of the United States with other countries regarding 
cybersecurity threats, including cyberattacks, theft, and data breaches, 
directed against the United States that threaten the United States’ na-
tional security interests, economy, and intellectual property, specifically 
identifying the relative utility of the relationships, which elements of 
the intelligence community participate in the relationships, and whether 
and how the relationships could be improved. 
(2) A list and an assessment of the countries and nonstate actors 
that are the primary threats of carrying out a cybersecurity threat, in-
cluding a cyberattack, theft, or data breach, against the United States 
that threatens the United States’ national security, economy, and intel-
lectual property. 
(3) A description of the extent to which the capabilities of the United 
States Government to respond to or prevent cybersecurity threats, in-
cluding cyberattacks, theft, or data breaches, directed against the 
United States private sector are degraded by a delay in the prompt no-
tification by private entities of those threats or cyberattacks, theft, and 
data breaches. 
(4) An assessment of additional technologies or capabilities that 
would enhance the ability of the United States to prevent and to re-
spond to cybersecurity threats, including cyberattacks, theft, and data 
breaches. 
(5) An assessment of any technologies or practices utilized by the 
private sector that could be rapidly fielded to assist the intelligence 
community in preventing and responding to cybersecurity threats. 
(d) FORM OF REPORT.—The report required by subsection (b) shall be 
made available in classified and unclassified forms. 
§ 10568. Exception to limitation on authority of Secretary of 
Defense to disseminate information 
Notwithstanding section 393(c)(3) of title 10, the Secretary of Defense 
may authorize the sharing of cyber threat indicators and defensive measures 
pursuant to the policies, procedures, and guidelines developed or issued 
under this part. 
§ 10569. Construction and preemption 
(a) OTHERWISE LAWFUL DISCLOSURES.—Nothing in this part shall be 
construed— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00145
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
146 
(1) to limit or prohibit otherwise lawful disclosures of communica-
tions, records, or other information, including reporting of known or 
suspected criminal activity, by a non-Federal entity to any other non- 
Federal entity or the Federal Government under this part; or 
(2) to limit or prohibit otherwise lawful use of the disclosures by any 
Federal entity, even when the otherwise lawful disclosures duplicate or 
replicate disclosures made under this part. 
(b) WHISTLE BLOWER PROTECTIONS.—Nothing in this part shall be con-
strued to prohibit or limit the disclosure of information protected under sec-
tion 2302(b)(8) or 7211 of title 5, section 1034 of title 10, section 1104 
of the National Security Act of 1947 (50 U.S.C. 3234), or any similar pro-
vision of Federal or State law. 
(c) PROTECTION OF SOURCES AND METHODS.—Nothing in this part shall 
be construed— 
(1) as creating any immunity against, or otherwise affecting, any ac-
tion brought by the Federal Government, or any agency or department 
of the Government, to enforce any law, executive order, or procedure 
governing the appropriate handling, disclosure, or use of classified in-
formation; 
(2) to affect the conduct of authorized law enforcement or intel-
ligence activities; or 
(3) to modify the authority of a department or agency of the Federal 
Government to protect classified information and sources and methods 
and the national security of the United States. 
(d) RELATIONSHIP TO OTHER LAWS.—Nothing in this part shall be con-
strued to affect any requirement under any other provision of law for a non- 
Federal entity to provide information to the Federal Government. 
(e) PROHIBITED CONDUCT.—Nothing in this part shall be construed to 
permit price-fixing, allocating a market between competitors, monopolizing 
or attempting to monopolize a market, boycotting, or exchanging price or 
cost information, customer lists, or information regarding future competitive 
planning. 
(f) INFORMATION SHARING RELATIONSHIPS.—Nothing in this part shall 
be construed— 
(1) to limit or modify an existing information sharing relationship; 
(2) to prohibit a new information sharing relationship; 
(3) to require a new information sharing relationship between any 
non-Federal entity and a Federal entity or another non-Federal entity; 
or 
(4) to require the use of the capability and process in the Depart-
ment developed under section 10564(d) of this title. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00146
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
147 
(g) PRESERVATION
OF CONTRACTUAL OBLIGATIONS
AND RIGHTS.— 
Nothing in this part shall be construed— 
(1) to amend, repeal, or supersede any current or future contractual 
agreement, terms of service agreement, or other contractual relation-
ship between non-Federal entities, or between a non-Federal entity and 
a Federal entity; or 
(2) to abrogate trade secret or intellectual property rights of a non- 
Federal entity or Federal entity. 
(h) ANTI-TASKING RESTRICTION.—Nothing in this part shall be con-
strued to permit a Federal entity— 
(1) to require a non-Federal entity to provide information to a Fed-
eral entity or another non-Federal entity; 
(2) to condition the sharing of cyber threat indicators with a non- 
Federal entity on the entity’s provision of cyber threat indicators to a 
Federal entity or another non-Federal entity; or 
(3) to condition the award of a Federal grant, contract, or purchase 
on the provision of a cyber threat indicator to a Federal entity or an-
other non-Federal entity. 
(i) NO LIABILITY FOR NON-PARTICIPATION.—Nothing in this part shall 
be construed to subject any entity to liability for choosing not to engage 
in the voluntary activities authorized in this part. 
(j) USE AND RETENTION OF INFORMATION.—Nothing in this part shall 
be construed to authorize, or to modify any existing authority of, a depart-
ment or agency of the Federal Government to retain or use any information 
shared under this part for any use other than permitted in this part. 
(k) FEDERAL PREEMPTION.— 
(1) IN GENERAL.—This part supersedes any statute or other provi-
sion of law of a State or political subdivision of a State that restricts 
or otherwise expressly regulates an activity authorized under this part. 
(2) STATE LAW ENFORCEMENT.—Nothing in this part shall be con-
strued to supersede any statute or other provision of law of a State 
or political subdivision of a State concerning the use of authorized law 
enforcement practices and procedures. 
(l) REGULATORY AUTHORITY.—Nothing in this part shall be construed— 
(1) to authorize the prescribing of any regulations not specifically 
authorized to be issued under this part; 
(2) to establish or limit any regulatory authority not specifically es-
tablished or limited under this part; or 
(3) to authorize regulatory actions that would duplicate or conflict 
with regulatory requirements, mandatory standards, or related proc-
esses under another provision of Federal law. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00147
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
179 
security plan and has demonstrated competency to carry out 
those requirements; 
(vii) the owner or operator has committed, or, in the case 
of planned measures, will commit, the necessary resources to 
fully implement the site security plan; and 
(viii) the planned measures include an adequate procedure 
for addressing events beyond the control of the owner or oper-
ator in implementing any planned measures. 
(D) DEADLINE.— 
(i) DATE FOR SUBMISSION TO SECRETARY.—The owner or 
operator of an expedited approval facility shall submit to the 
Secretary the site security plan and the certification described 
in subparagraph (C) not later than 120 days after— 
(I) for an expedited approval facility that was assigned 
to tier 3 or 4 under existing CFATS regulations before 
December 18, 2014, the date that is 210 days after De-
cember 18, 2014; and 
(II) for any expedited approval facility not described 
in subclause (I), the later of— 
(aa) the date on which the expedited approval fa-
cility is assigned to tier 3 or 4 under subsection 
(e)(2)(A); or 
(bb) the date that is 210 days after December 18, 
2014. 
(ii) NOTICE.—An owner or operator of an expedited ap-
proval facility shall notify the Secretary of the intent of the 
owner or operator to certify the site security plan for the ex-
pedited approval facility not later than 30 days before the 
date on which the owner or operator submits the site security 
plan and certification described in subparagraph (C). 
(E) COMPLIANCE.— 
(i) IN GENERAL.—For an expedited approval facility sub-
mitting a site security plan and certification in accordance 
with subparagraphs (A), (B), (C), and (D)— 
(I) the expedited approval facility shall comply with all 
of the requirements of its site security plan; and 
(II) the Secretary— 
(aa) except as provided in subparagraph (G), may 
not disapprove the site security plan; and 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00179
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
180 
(bb) may audit and inspect the expedited ap-
proval facility under subsection (e) to verify compli-
ance with its site security plan. 
(ii) NONCOMPLIANCE.—If the Secretary determines an ex-
pedited approval facility is not in compliance with the require-
ments of the site security plan or is otherwise in violation of 
this subchapter, the Secretary may enforce compliance in ac-
cordance with section 10654 of this title. 
(F) AMENDMENTS TO SITE SECURITY PLAN.— 
(i) REQUIREMENT.— 
(I) IN GENERAL.—If the owner or operator of an ex-
pedited approval facility amends a site security plan sub-
mitted under subparagraph (A), the owner or operator 
shall submit the amended site security plan and a certifi-
cation relating to the amended site security plan that 
contains the information described in subparagraph (C). 
(II) TECHNICAL AMENDMENTS.—For purposes of this 
clause, an amendment to a site security plan includes 
any technical amendment to the site security plan. 
(ii) WHEN AMENDMENT REQUIRED.—The owner or oper-
ator of an expedited approval facility shall amend the site se-
curity plan if— 
(I) there is a change in the design, construction, oper-
ation, or maintenance of the expedited approval facility 
that affects the site security plan; 
(II) the Secretary requires additional security meas-
ures or suspends a certification and recommends addi-
tional security measures under subparagraph (G); or 
(III) the owner or operator receives notice from the 
Secretary of a change in tiering under subsection (f)(3). 
(iii) DEADLINE.—An amended site security plan and cer-
tification shall be submitted under clause (i)— 
(I) in the case of a change in design, construction, op-
eration, or maintenance of the expedited approval facility 
that affects the security plan, not later than 120 days 
after the date on which the change in design, construc-
tion, operation, or maintenance occurred; 
(II) in the case of the Secretary requiring additional 
security measures or suspending a certification and rec-
ommending additional security measures under subpara-
graph (G), not later than 120 days after the date on 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00180
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
181 
which the owner or operator receives notice of the re-
quirement for additional security measures or suspension 
of the certification and recommendation of additional se-
curity measures; and 
(III) in the case of a change in tiering, not later than 
120 days after the date on which the owner or operator 
receives notice under subsection (f)(3). 
(G) FACIALLY DEFICIENT SITE SECURITY PLANS.— 
(i) PROHIBITION.—Notwithstanding subparagraph (A) or 
(E), the Secretary may suspend the authority of a covered 
chemical facility to certify a site security plan if the Sec-
retary— 
(I) determines the certified site security plan or an 
amended site security plan is facially deficient; and 
(II) not later than 100 days after the date on which 
the Secretary receives the site security plan and certifi-
cation, provides the covered chemical facility with written 
notification that the site security plan is facially defi-
cient, including a clear explanation of each deficiency in 
the site security plan. 
(ii) ADDITIONAL SECURITY MEASURES.— 
(I) IN GENERAL.—If, during or after a compliance in-
spection of an expedited approval facility, the Secretary 
determines that planned or implemented security meas-
ures in the site security plan of the facility are insuffi-
cient to meet the risk-based performance standards 
based on misrepresentation, omission, or an inadequate 
description of the site, the Secretary may— 
(aa) require additional security measures; or 
(bb) suspend the certification of the facility. 
(II) RECOMMENDATION
OF
ADDITIONAL
SECURITY 
MEASURES.—If the Secretary suspends the certification 
of an expedited approval facility under subclause (I), the 
Secretary shall— 
(aa) recommend specific additional security meas-
ures that, if made part of the site security plan by 
the facility, would enable the Secretary to approve 
the site security plan; and 
(bb) provide the facility an opportunity to submit 
a new or modified site security plan and certifi-
cation under subparagraph (A). 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00181
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
182 
(III) SUBMISSION; REVIEW.—If an expedited approval 
facility determines to submit a new or modified site secu-
rity plan and certification as authorized under subclause 
(II)(bb)— 
(aa) not later than 90 days after the date on 
which the facility receives recommendations under 
subclause (II)(aa), the facility shall submit the new 
or modified plan and certification; and 
(bb) not later than 45 days after the date on 
which the Secretary receives the new or modified 
plan under item (aa), the Secretary shall review the 
plan and determine whether the plan is facially defi-
cient. 
(IV) DETERMINATION NOT TO INCLUDE ADDITIONAL 
SECURITY MEASURES.— 
(aa) REVOCATION OF CERTIFICATION.—If an ex-
pedited approval facility does not agree to include in 
its site security plan specific additional security 
measures recommended by the Secretary under sub-
clause (II)(aa), or does not submit a new or modi-
fied site security plan in accordance with subclause 
(III), the Secretary may revoke the certification of 
the facility by issuing an order under section 
10654(a)(1)(B) of this title. 
(bb) EFFECT OF REVOCATION.—If the Secretary 
revokes the certification of an expedited approval fa-
cility under item (aa) by issuing an order under sec-
tion 10654(a)(1)(B) of this title— 
(AA) the order shall require the owner or op-
erator of the facility to submit a site security 
plan or alternative security program for review 
by the Secretary under subsection (d)(1) or 
(2); and 
(BB) the facility shall no longer be eligible 
to certify a site security plan under this para-
graph. 
(V) FACIAL DEFICIENCY.—If the Secretary determines 
that a new or modified site security plan submitted by 
an expedited approval facility under subclause (III) is 
facially deficient— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00182
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
247 
seized by the Office of Field Operations in the immediately pre-
ceding 5 fiscal years. 
(D) The number of infractions related to travelers and cargo 
committed by major violators who are interdicted by the Office of 
Field Operations at ports of entry, and the estimated number of 
those infractions committed by major violators who are not so 
interdicted. 
(E) In consultation with the heads of the Office of National 
Drug Control Policy and the United States Southern Command, 
a cocaine seizure effectiveness rate, which is the percentage result-
ing from dividing the amount of cocaine seized by the Office of 
Field Operations by the total estimated cocaine flow rate at ports 
of entry along the United States land border with Mexico and 
Canada. 
(F) A measurement of how border security operations affect 
crossing times, including the following: 
(i) A wait time ratio that compares the average wait times 
to total commercial and private vehicular traffic volumes at 
each land port of entry. 
(ii) An infrastructure capacity utilization rate that meas-
ures traffic volume against the physical and staffing capacity 
at each land port of entry. 
(iii) A secondary examination rate that measures the fre-
quency of secondary examinations at each land port of entry. 
(iv) An enforcement rate that measures the effectiveness of 
the secondary examinations at detecting major violators. 
(G) A seaport scanning rate that includes the following: 
(i) The number of all cargo containers that are considered 
potentially high-risk, as determined by the Executive Assist-
ant Commissioner of the Office of Field Operations. 
(ii) A comparison of the number of potentially high-risk 
cargo containers scanned by the Office of Field Operations at 
each sea port of entry during a fiscal year to the total num-
ber of high-risk cargo containers entering the United States 
at each such sea port of entry during the previous fiscal year. 
(iii) The number of potentially high-risk cargo containers 
scanned on arrival at a United States sea port of entry. 
(iv) The number of potentially high-risk cargo containers 
scanned before arrival at a United States sea port of entry. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00247
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
271 
(B) operation and maintenance of the port of entry facility. 
(3) LIMITATION ON REAL PROPERTY DONATIONS.—A donation of 
real property under this subsection at an existing land port of entry 
owned by the General Services Administration may only be accepted by 
the Administrator of General Services. 
(4) SUNSET.— 
(A) IN GENERAL.—The authority to enter into an agreement 
under this subsection shall terminate on December 16, 2020. 
(B) RULE OF CONSTRUCTION.—The termination date referred 
to in subparagraph (A) shall not apply to carrying out the terms 
of an agreement under this subsection if the agreement is entered 
into before December 16, 2020. 
(c) GENERAL PROVISIONS.— 
(1) DURATION.—An agreement entered into under subsection (a) or 
(b) (and in the case of subsection (b), in accordance with paragraph 
(4) of subsection (b)) may last as long as required to meet the terms 
of the agreement. 
(2) CRITERIA.—In carrying out an agreement entered into under 
subsection (a) or (b), the Commissioner of U.S. Customs and Border 
Protection, in consultation with the Administrator of General Services, 
shall establish criteria regarding— 
(A) the selection and evaluation of donors; 
(B) the identification of roles and responsibilities between U.S. 
Customs and Border Protection, the General Services Administra-
tion, and donors; 
(C) the identification, allocation, and management of explicit 
and implicit risks of partnering between the Federal Government 
and donors; 
(D) decision-making and dispute resolution processes; and 
(E) processes for U.S. Customs and Border Protection, and the 
General Services Administration, as applicable, to terminate agree-
ments if selected donors are not meeting the terms of the agree-
ment, including the security standards established by U.S. Cus-
toms and Border Protection. 
(3) EVALUATION PROCEDURES.— 
(A) IN GENERAL.—The Commissioner of U.S. Customs and 
Border Protection, in consultation with the Administrator of Gen-
eral Services, as applicable, shall— 
(i) establish criteria for evaluating a proposal to enter into 
an agreement under subsection (a) or (b); and 
(ii) make the criteria publicly available. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00271
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
316 
(F) THIRD
PARTIES.—To be accredited under subparagraph 
(C), a third party shall— 
(i) demonstrate that the third party has the ability to cer-
tify private-sector entities in accordance with the procedures 
and requirements developed subparagraph (B); 
(ii) agree to perform certifications in accordance with the 
procedures and requirements; 
(iii) agree not to have a beneficial interest in or direct or 
indirect control over— 
(I) a private-sector entity for which that third party 
conducts a certification under this subsection; or 
(II) an organization that provides preparedness con-
sulting services to private-sector entities; 
(iv) agree not to have any other conflict of interest with re-
spect to a private-sector entity for which the third party con-
ducts a certification under this subsection; 
(v) maintain liability insurance coverage at policy limits in 
accordance with the requirements developed under subpara-
graph (B); and 
(vi) enter into an agreement with the selected entity ac-
crediting that third party to protect proprietary information 
of a private-sector entity obtained under this subsection. 
(G) MONITORING.— 
(i) ENSURE COMPLIANCE.—The designated officer and an 
selected entity shall regularly monitor and inspect the oper-
ations of a third party conducting certifications under this 
subsection to ensure that the third party is complying with 
the procedures and requirements established under subpara-
graph (B) and all other applicable requirements. 
(ii) PROCEDURES OR REQUIREMENTS NOT MET.—If the 
designated officer or a selected entity determines that a third 
party is not meeting the procedures or requirements estab-
lished under subparagraph (B), the selected entity shall— 
(I) revoke the accreditation of that third party to con-
duct certifications under this subsection; and 
(II) review the certification conducted by that third 
party, as necessary and appropriate. 
(4) ANNUAL REVIEW.— 
(A) IN GENERAL.—The designated officer, in consultation with 
representatives of appropriate organizations that coordinate or fa-
cilitate the development and use of voluntary consensus standards, 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00316
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
394 
(2) comply with the National Emergency Communications Plan 
under section 12103 of this title, when completed. 
(c) ADMINISTRATION.— 
(1) IN GENERAL.—The Administrator of the Federal Emergency 
Management Agency shall administer the Interoperable Emergency 
Communications Grant Program pursuant to the responsibilities and 
authorities of the Administrator under chapter 111 of this title. 
(2) GUIDANCE.—In administering the grant program, the Adminis-
trator shall ensure that the use of grants is consistent with guidance 
established by the Director of Emergency Communications under sec-
tion 10712(b)(1)(H) of this title. 
(d) USE OF FUNDS.—A State that receives a grant under this section 
shall use the grant to implement that State’s Statewide Interoperable Com-
munications Plan required under section 10712(e) of this title and approved 
under subsection (e) of this section, and to assist with activities determined 
by the Secretary to be integral to interoperable emergency communications. 
(e) APPROVAL OF PLANS.— 
(1) APPROVAL AS CONDITION OF GRANT.—Before a State may re-
ceive a grant under this section, the Director of Emergency Commu-
nications shall approve the State’s Statewide Interoperable Communica-
tions Plan required under section 10712(e) of this title. 
(2) PLAN REQUIREMENTS.—In approving a plan under this sub-
section, the Director of Emergency Communications shall ensure that 
the plan— 
(A) is designed to improve interoperability at the city, county, 
regional, State, and interstate level; 
(B) considers any applicable local or regional plan; and 
(C) complies, to the maximum extent practicable, with the Na-
tional Emergency Communications Plan under section 12103 of 
this title. 
(3) APPROVAL OF REVISIONS.—The Director of Emergency Commu-
nications may approve revisions to a State’s plan if the Director deter-
mines that doing so is likely to further interoperability. 
(f) LIMITATIONS ON USES OF FUNDS.— 
(1) IN GENERAL.—The recipient of a grant under this section may 
not use the grant— 
(A) to supplant State or local funds; 
(B) for any State or local government cost-sharing contribution; 
or 
(C) for recreational or social purposes. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00394
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
669 
(i) in subsection (a), by striking ‘‘section 46502(a), 46504, 
46505, or 46506’’ and inserting ‘‘section 46504’’; and 
(ii) in subsection (b)(1), by striking ‘‘The Secretary of 
Homeland Security and, for a violation relating to section 
46504, the Secretary of Transportation,’’ and inserting ‘‘The 
Secretary of Transportation’’; 
(C) in section 46306(d)(1), by striking ‘‘Commissioner of Cus-
toms’’ and inserting ‘‘Commissioner of U. S. Customs and Border 
Enforcement’’; 
(D) in section 46311— 
(i) by striking ‘‘, Under Secretary,’’ each place it appears; 
and 
(ii) in subsection (a), by striking ‘‘ the Under Secretary of 
Transportation for Security with respect to security duties 
and powers designated to be carried out by the Under Sec-
retary,’’; 
(E) in section 46313, by striking ‘‘the Under Secretary of 
Transportation for Security with respect to security duties and 
powers designated to be carried out by the Under Secretary or’’; 
and 
(F) in section 46316— 
(i) in subsection (a), by striking ‘‘the Under Secretary of 
Transportation for Security with respect to security duties 
and powers designated to be carried out by the Under Sec-
retary or’’; and 
(ii) in subsection (b), by striking ‘‘chapter 447 (except sec-
tion 44718(a)), and chapter 449 (except sections 44902, 
44903(d), 44904, and 44907–44909)’’ and inserting ‘‘and 
chapter 447 (except section 44718(a))’’. 
(m) TITLE 50, UNITED STATES CODE.—Title 50, United States Code, 
is amended as follows: 
(1) Section 1414(b) of the National Defense Authorization Act for 
Fiscal Year 1997 (50 U.S.C. 2314(b)) is amended by striking ‘‘section 
502(6) of the Homeland Security Act of 2002’’ and inserting ‘‘section 
11103(6) of title 6, United States Code,’’. 
(2) Section 1415(a)(2) of the National Defense Authorization Act for 
Fiscal Year 1997 (50 U.S.C. 2315(a)(2)) is amended by striking ‘‘sec-
tions 102(c) and 430(c)(1) of the Homeland Security Act of 2002’’ and 
inserting ‘‘sections 10323(b)(1) and 10331(h) of title 6, United States 
Code’’. 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00669
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
676 
Schedule of Laws Repealed—Continued 
Statutes at Large 
Act 
Section 
United States Code Former 
Classification 
1411 .........................................
6 U.S.C. 1140.
1412 .........................................
6 U.S.C. 1141.
1413 .........................................
6 U.S.C. 1142.
1414 .........................................
6 U.S.C. 1143.
1415 .........................................
6 U.S.C. 1144.
1501 .........................................
6 U.S.C. 1151.
1502 .........................................
6 U.S.C. 1152.
1503 .........................................
6 U.S.C. 1153.
1504 .........................................
6 U.S.C. 1154.
1511 .........................................
6 U.S.C. 1161.
1512 .........................................
6 U.S.C. 1162.
1513 .........................................
6 U.S.C. 1163.
1514 .........................................
6 U.S.C. 1164.
1515 .........................................
6 U.S.C. 1165.
1516 .........................................
6 U.S.C. 1166.
1517 .........................................
6 U.S.C. 1167.
1518 .........................................
6 U.S.C. 1168.
1519 .........................................
6 U.S.C. 1169.
1522 .........................................
6 U.S.C. 1170.
1524 .........................................
6 U.S.C. 1171.
1526(b) ....................................
6 U.S.C. 1172.
1531 .........................................
6 U.S.C. 1181.
1532 .........................................
6 U.S.C. 1182.
1533 .........................................
6 U.S.C. 1183.
1534 .........................................
6 U.S.C. 1184.
1535 .........................................
6 U.S.C. 1185.
1541 .........................................
6 U.S.C. 1186.
1551 .........................................
6 U.S.C. 1201.
1552 .........................................
6 U.S.C. 1202.
1553 .........................................
6 U.S.C. 1203.
1554 .........................................
6 U.S.C. 1204.
1555 .........................................
6 U.S.C. 1205.
1556(b) ....................................
6 U.S.C. 1206.
1557 .........................................
6 U.S.C. 1207.
1558 .........................................
6 U.S.C. 1208.
2205 .........................................
6 U.S.C. 194 note.
2403 .........................................
6 U.S.C. 121 note.
Border Infrastructure and Technology 
Modernization Act of 2007 (Public 
Law 110–161) .....................................
602 ...........................................
6 U.S.C. 1401.
606 ...........................................
6 U.S.C. 1405.
American Recovery and Reinvestment 
Act of 2009 (Public Law 111–5) ........
604 ...........................................
6 U.S.C. 453b.
Department of Homeland Security Ap-
propriations Act, 2010 (Public Law 
111–83) ...............................................
554 ...........................................
6 U.S.C. 469a.
Coast Guard Authorization Act of 2010 
(Public Law 111–281) ........................
825 ...........................................
6 U.S.C. 945 note.
Anti-Border Corruption Act of 2010 
(Public Law 111–376) ........................
3 ...............................................
6 U.S.C. 221.
Consolidated Appropriations Act, 2012 
(Public Law 112–74) ..........................
526 ...........................................
6 U.S.C. 453c.
538 ...........................................
6 U.S.C. 190 note.
546 ...........................................
6 U.S.C. 124j note.
557 ...........................................
6 U.S.C. 222.
(last provision in paragraph 
under heading 
‘‘CONSTRUCTION AND 
FACILITIES MANAGEMENT’’, 
125 Stat. 949).
6 U.S.C. 214 note.
National Defense Authorization Act for 
Fiscal Year 2012 (Public Law 112– 
81) .......................................................
1090 .........................................
6 U.S.C. 121 note.
Border Tunnel Prevention Act of 2012 
(Public Law 112–127) ........................
8 ...............................................
6 U.S.C. 257.
Intelligence Authorization Act for Fiscal 
Year 2013 (Public Law 112–277) ......
501 ...........................................
6 U.S.C. 121a.
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00676
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
677 
Schedule of Laws Repealed—Continued 
Statutes at Large 
Act 
Section 
United States Code Former 
Classification 
Department of Homeland Security Ap-
propriations Act, 2013 (Public Law 
113–6) .................................................
div. D, title III, last proviso on 
p. 359.
6 U.S.C. 763a.
div. D, title V, § 540 ................
6 U.S.C. 416.
Department of Homeland Security Ap-
propriation Act, 2014 (Public Law 
113–76) ...............................................
div. F, title V, § 569 ................
6 U.S.C. 471.
Cybersecurity Workforce Assessment Act 
(Public Law 113–246) ........................
2 ...............................................
6 U.S.C. 146 note.
3 ...............................................
6 U.S.C. 146.
Protecting and Securing Chemical Facili-
ties from Terrorist Attacks Act of 
2014 (Public Law 113–254) ...............
5 ...............................................
6 U.S.C. 621 note.
Homeland Security Cybersecurity Work-
force Assessment Act (Public Law 
113–277) .............................................
4(b) through (e) ......................
6 U.S.C. 146 note.
National Cybersecurity Protection Act of 
2014 (Public Law 113–282) ...............
8 ...............................................
6 U.S.C. 148 note.
Intelligence Authorization Act for Fiscal 
Year 2015 (Public Law 113–293) ......
324 ...........................................
6 U.S.C. 125.
Department of Homeland Security Ap-
propriations Act, 2015 (Public Law 
114–4) .................................................
562 ...........................................
6 U.S.C. 472.
Justice for Victims of Trafficking Act of 
2015 (Public Law 114–22) .................
901 ...........................................
6 U.S.C. 641.
902 ...........................................
6 U.S.C. 642.
903 ...........................................
6 U.S.C. 643.
904 ...........................................
6 U.S.C. 644.
Department of Homeland Security Inter-
operable Communications Act (Public 
Law 114–29) .......................................
2 ...............................................
6 U.S.C. 194 note.
3 ...............................................
6 U.S.C. 194 note, 341.
4 through 6 .............................
6 U.S.C. 194 note.
Border Jobs for Veterans Act of 2015 
(Public Law 114–68) ..........................
3 through 6 ..............................
6 U.S.C. 211 note.
Federal Cybersecurity Enhancement Act 
of 2015 (Public Law 114–113) ...........
div. N, title I, § 102 .................
6 U.S.C. 1501.
div. N, title I, § 103 .................
6 U.S.C. 1502.
div. N, title I, § 104 .................
6 U.S.C. 1503.
div. N, title I, § 105 .................
6 U.S.C. 1504.
div. N, title I, § 106 .................
6 U.S.C. 1505.
div. N, title I, § 107 .................
6 U.S.C. 1506.
div. N, title I, § 108 .................
6 U.S.C. 1507.
div. N, title I, § 109 .................
6 U.S.C. 1508.
div. N, title I, § 110 .................
6 U.S.C. 1509.
div. N, title I, § 111 .................
6 U.S.C. 1510.
div. N, title II, § 222 ...............
6 U.S.C. 1521.
div. N, title II, § 223(b) ..........
6 U.S.C. 151 note.
div. N, title II, § 224 ...............
6 U.S.C. 1522.
div. N, title II, § 225 ...............
6 U.S.C. 1523.
div. N, title II, § 226 ...............
6 U.S.C. 1524.
div. N, title II, § 227 ...............
6 U.S.C. 1525.
div. N, title IV, § 403 ..............
6 U.S.C. 1531.
div. N, title IV, § 404 ..............
6 U.S.C. 1532.
div. N, title IV, § 405 ..............
6 U.S.C. 1533.
Trade Facilitation and Trade Enforce-
ment Act of 2015 (Public Law 114– 
125) .....................................................
title VIII, § 802(j) ...................
8 U.S.C. 1185 note.
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00677
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
678 
Schedule of Laws Repealed—Continued 
Statutes at Large 
Act 
Section 
United States Code Former 
Classification 
National Defense Authorization Act for 
Fiscal Year 2017 (Public Law 114– 
328) .....................................................
div. A, title X, § 1086 ..............
6 U.S.C. 104.
div. A, title X, § 1092 ..............
6 U.S.C. 223.
United States Code 
Title 
Section 
49 .................................................................
114 
......................................................................
115 
......................................................................
44901 
......................................................................
44902 
......................................................................
44903 
......................................................................
44904 
......................................................................
44905 
......................................................................
44906 
......................................................................
44907 
......................................................................
44908 
......................................................................
44909 
......................................................................
44910 
......................................................................
44911 
......................................................................
44912 
......................................................................
44913 
......................................................................
44914 
......................................................................
44915 
......................................................................
44916 
......................................................................
44917 
......................................................................
44918 
......................................................................
44919 
......................................................................
44920 
......................................................................
44921 
......................................................................
44922 
......................................................................
44923 
......................................................................
44924 
......................................................................
44925 
......................................................................
44926 
......................................................................
44927 
......................................................................
44928 
......................................................................
44933 
......................................................................
44934 
......................................................................
44935 
......................................................................
44936 
......................................................................
44937 
......................................................................
44938 
......................................................................
44939 
......................................................................
44940 
......................................................................
44941 
......................................................................
44942 
......................................................................
44943 
......................................................................
44944 
......................................................................
44945 
......................................................................
44946 
Æ 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00678
Fmt 6652
Sfmt 6301
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS