related to a cybersecurity risk or inci-
dent, and to safeguard information 
that can be used to identify specific 
persons from unintended disclosure or 
unauthorized access or acquisition; 
‘‘(III) shall consider such infor-
mation the commercial, financial, and 
proprietary information of such Fed-
eral entity or non-Federal entity if so 
designated by such Federal entity or 
non-Federal entity; 
‘‘(IV) shall be deemed to have 
voluntarily shared such cyber threat 
indicators or defensive measures; and 
‘‘(V) shall implement and utilize 
a security control to protect against 
unauthorized access to or acquisition 
of such cyber threat indicators or de-
fensive measures. 
‘‘(ii) PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
‘‘(I) shall be exempt from disclo-
sure under any State, local, or tribal 
law or regulation that requires public 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
disclosure of information or records 
by a public or quasi-public entity; and 
‘‘(II) may not be used by any 
State, local, or tribal government to 
regulate a lawful activity of a non- 
Federal entity. 
‘‘(8) LIABILITY EXEMPTIONS.— 
‘‘(A) NETWORK AWARENESS.—No cause of 
action shall lie or be maintained in any court, 
and such action shall be promptly dismissed, 
against any non-Federal entity that, for cyber-
security purposes, conducts network awareness 
under paragraph (4), if such network awareness 
is conducted in good faith in accordance with 
such paragraph and this section. 
‘‘(B) INFORMATION
SHARING.—No cause 
of action shall lie or be maintained in any 
court, and such action shall be promptly dis-
missed, against any non-Federal entity that, for 
cybersecurity purposes, shares cyber threat in-
dicators or defensive measures under paragraph 
(3), or in good faith fails to act based on such 
sharing, if such sharing is conducted in good 
faith in accordance with such paragraph and 
this section. 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(C) WILLFUL MISCONDUCT.— 
‘‘(i) RULE OF CONSTRUCTION.—Noth-
ing in this section may be construed to— 
‘‘(I) require dismissal of a cause 
of action against a non-Federal entity 
that has engaged in willful misconduct 
in the course of conducting activities 
authorized by this section; or 
‘‘(II) undermine or limit the 
availability of otherwise applicable 
common law or statutory defenses. 
‘‘(ii) 
PROOF
OF
WILLFUL
MIS-
CONDUCT.—In any action claiming that 
subparagraph (A) or (B) does not apply 
due to willful misconduct described in 
clause (i), the plaintiff shall have the bur-
den of proving by clear and convincing evi-
dence the willful misconduct by each non- 
Federal entity subject to such claim and 
that such willful misconduct proximately 
caused injury to the plaintiff. 
‘‘(iii) 
WILLFUL
MISCONDUCT
DE-
FINED.—In this subsection, the term ‘will-
ful misconduct’ means an act or omission 
that is taken— 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(I) intentionally to achieve a 
wrongful purpose; 
‘‘(II) knowingly without legal or 
factual justification; and 
‘‘(III) in disregard of a known or 
obvious risk that is so great as to 
make it highly probable that the harm 
will outweigh the benefit. 
‘‘(D) EXCLUSION.—The term ‘non-Federal 
entity’ as used in this paragraph shall not in-
clude a State, local, or tribal government. 
‘‘(9) FEDERAL
GOVERNMENT
LIABILITY
FOR 
VIOLATIONS
OF
RESTRICTIONS
ON
THE
USE
AND 
PROTECTION
OF
VOLUNTARILY
SHARED
INFORMA-
TION.— 
‘‘(A) IN
GENERAL.—If a department or 
agency of the Federal Government intentionally 
or willfully violates the restrictions specified in 
paragraph (3), (6), or (7)(B) on the use and 
protection of voluntarily shared cyber threat in-
dicators or defensive measures, or any other 
provision of this section, the Federal Govern-
ment shall be liable to a person injured by such 
violation in an amount equal to the sum of— 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(i) the actual damages sustained by 
such person as a result of such violation or 
$1,000, whichever is greater; and 
‘‘(ii) reasonable attorney fees as deter-
mined by the court and other litigation 
costs reasonably occurred in any case 
under this subsection in which the com-
plainant has substantially prevailed. 
‘‘(B) VENUE.—An action to enforce liabil-
ity under this subsection may be brought in the 
district court of the United States in— 
‘‘(i) the district in which the com-
plainant resides; 
‘‘(ii) the district in which the principal 
place of business of the complainant is lo-
cated; 
‘‘(iii) the district in which the depart-
ment or agency of the Federal Government 
that disclosed the information is located; or 
‘‘(iv) the District of Columbia. 
‘‘(C) STATUTE OF LIMITATIONS.—No ac-
tion shall lie under this subsection unless such 
action is commenced not later than two years 
after the date of the violation of any restriction 
specified in paragraph (3), (6), or 7(B), or any 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
other provision of this section, that is the basis 
for such action. 
‘‘(D) EXCLUSIVE
CAUSE
OF
ACTION.—A 
cause of action under this subsection shall be 
the exclusive means available to a complainant 
seeking a remedy for a violation of any restric-
tion specified in paragraph (3), (6), or 7(B) or 
any other provision of this section. 
‘‘(10) ANTI-TRUST EXEMPTION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (C), it shall not be considered a 
violation of any provision of antitrust laws for 
two or more non-Federal entities to share a 
cyber threat indicator or defensive measure, or 
assistance relating to the prevention, investiga-
tion, or mitigation of a cybersecurity risk or in-
cident, for cybersecurity purposes under this 
Act. 
‘‘(B) APPLICABILITY.—Subparagraph (A) 
shall apply only to information that is shared or 
assistance that is provided in order to assist 
with— 
‘‘(i) facilitating the prevention, inves-
tigation, or mitigation of a cybersecurity 
risk or incident to an information system 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
or information that is stored on, processed 
by, or transiting an information system; or 
‘‘(ii) communicating or disclosing a 
cyber threat indicator or defensive measure 
to help prevent, investigate, or mitigate the 
effect of a cybersecurity risk or incident to 
an information system or information that 
is stored on, processed by, or transiting an 
information system. 
‘‘(C) PROHIBITED CONDUCT.—Nothing in 
this section may be construed to permit price- 
fixing, allocating a market between competitors, 
monopolizing or attempting to monopolize a 
market, or exchanges of price or cost informa-
tion, customer lists, or information regarding 
future competitive planning. 
‘‘(11) CONSTRUCTION AND PREEMPTION.— 
‘‘(A) 
OTHERWISE
LAWFUL
DISCLO-
SURES.—Nothing in this section may be con-
strued to limit or prohibit otherwise lawful dis-
closures of communications, records, or other 
information, including reporting of known or 
suspected criminal activity or participating vol-
untarily or under legal requirement in an inves-
tigation, by a non-Federal to any other non- 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
Federal entity or Federal entity under this sec-
tion. 
‘‘(B) WHISTLEBLOWER
PROTECTIONS.— 
Nothing in this section may be construed to 
prohibit or limit the disclosure of information 
protected under section 2302(b)(8) of title 5, 
United States Code (governing disclosures of il-
legality, waste, fraud, abuse, or public health or 
safety threats), section 7211 of title 5, United 
States Code (governing disclosures to Con-
gress), section 1034 of title 10, United States 
Code (governing disclosure to Congress by 
members of the military), section 1104 of the 
National Security Act of 1947 (50 U.S.C. 
3234) (governing disclosure by employees of 
elements of the intelligence community), or any 
similar provision of Federal or State law. 
‘‘(C) RELATIONSHIP
TO
OTHER
LAWS.— 
Nothing in this section may be construed to af-
fect any requirement under any other provision 
of law for a non-Federal entity to provide infor-
mation to a Federal entity. 
‘‘(D) PRESERVATION
OF
CONTRACTUAL 
OBLIGATIONS
AND
RIGHTS.—Nothing in this 
section may be construed to— 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(i) amend, repeal, or supersede any 
current or future contractual agreement, 
terms of service agreement, or other con-
tractual relationship between any non-Fed-
eral entities, or between any non-Federal 
entity and a Federal entity; or 
‘‘(ii) abrogate trade secret or intellec-
tual property rights of any non-Federal en-
tity or Federal entity. 
‘‘(E) ANTI-TASKING RESTRICTION.—Noth-
ing in this section may be construed to permit 
a Federal entity to— 
‘‘(i) require a non-Federal entity to 
provide information to a Federal entity; 
‘‘(ii) condition the sharing of cyber 
threat indicators or defensive measures 
with a non-Federal entity on such non- 
Federal entity’s provision of cyber threat 
indicators or defensive measures to a Fed-
eral entity; or 
‘‘(iii) condition the award of any Fed-
eral grant, contract, or purchase on the 
sharing of cyber threat indicators or defen-
sive measures with a Federal entity. 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(F) NO LIABILITY FOR NON-PARTICIPA-
TION.—Nothing in this section may be con-
strued to subject any non-Federal entity to li-
ability for choosing to not engage in the vol-
untary activities authorized under this section. 
‘‘(G) USE AND RETENTION OF INFORMA-
TION.—Nothing in this section may be con-
strued to authorize, or to modify any existing 
authority of, a department or agency of the 
Federal Government to retain or use any infor-
mation shared under this section for any use 
other than permitted in this section. 
‘‘(H) VOLUNTARY
SHARING.—Nothing in 
this section may be construed to restrict or con-
dition a non-Federal entity from sharing, for 
cybersecurity purposes, cyber threat indicators, 
defensive measures, or information related to 
cybersecurity risks or incidents with any other 
non-Federal entity, and nothing in this section 
may be construed as requiring any non-Federal 
entity to share cyber threat indicators, defen-
sive measures, or information related to cyber-
security risks or incidents with the Center. 
‘‘(I) FEDERAL PREEMPTION.—This section 
supersedes any statute or other provision of law 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
of a State or political subdivision of a State 
that restricts or otherwise expressly regulates 
an activity authorized under this section.’’. 
SEC. 4. INFORMATION SHARING AND ANALYSIS ORGANIZA-
TIONS. 
Section 212 of the Homeland Security Act of 2002 
(6 U.S.C. 131) is amended— 
(1) in paragraph (5)— 
(A) in subparagraph (A)— 
(i) by inserting ‘‘information related 
to cybersecurity risks and incidents and’’ 
after ‘‘critical infrastructure information’’; 
and 
(ii) by striking ‘‘related to critical in-
frastructure’’ and inserting ‘‘related to cy-
bersecurity risks, incidents, critical infra-
structure, and’’; 
(B) in subparagraph (B)— 
(i) by striking ‘‘disclosing critical in-
frastructure information’’ and inserting 
‘‘disclosing cybersecurity risks, incidents, 
and critical infrastructure information’’; 
and 
(ii) by striking ‘‘related to critical in-
frastructure or’’ and inserting ‘‘related to 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
cybersecurity risks, incidents, critical infra-
structure, or’’ and 
(C) in subparagraph (C), by striking ‘‘dis-
seminating critical infrastructure information’’ 
and 
inserting 
‘‘disseminating 
cybersecurity 
risks, incidents, and critical infrastructure in-
formation’’; and 
(2) by adding at the end the following new 
paragraph: 
‘‘(8) CYBERSECURITY
RISK; INCIDENT.—The 
terms ‘cybersecurity risk’ and ‘incident’ have the 
meanings given such terms in the second section 226 
(relating to the National Cybersecurity and Commu-
nications Integration Center).’’. 
SEC. 5. PROHIBITION ON NEW REGULATORY AUTHORITY. 
Nothing in this Act or the amendments made by this 
Act may be construed to grant the Secretary of Homeland 
Security any authority to promulgate regulations or set 
standards relating to the cybersecurity of non-Federal en-
tities, not including State, local, and tribal governments, 
that was not in effect on the day before the date of the 
enactment of this Act. 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
SEC. 6. STREAMLINING OF DEPARTMENT OF HOMELAND 
SECURITY 
CYBERSECURITY 
AND 
INFRA-
STRUCTURE PROTECTION ORGANIZATION. 
(a) CYBERSECURITY
AND INFRASTRUCTURE PRO-
TECTION.—The National Protection and Programs Direc-
torate of the Department of Homeland Security shall, 
after the date of the enactment of this Act, be known and 
designated as the ‘‘Cybersecurity and Infrastructure Pro-
tection’’. Any reference to the National Protection and 
Programs Directorate of the Department in any law, regu-
lation, map, document, record, or other paper of the 
United States shall be deemed to be a reference to the 
Cybersecurity and Infrastructure Protection of the De-
partment. 
(b) SENIOR LEADERSHIP OF CYBERSECURITY AND 
INFRASTRUCTURE PROTECTION.— 
(1) IN
GENERAL.—Subsection (a) of section 
103 of the Homeland Security Act of 2002 (6 
U.S.C. 113) is amended— 
(A) in paragraph (1)— 
(i) by amending subparagraph (H) to 
read as follows: 
‘‘(H) An Under Secretary for Cybersecu-
rity and Infrastructure Protection.’’; and 
(ii) by adding at the end the following 
new subparagraphs: 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(K) A Deputy Under Secretary for Cyber-
security. 
‘‘(L) A Deputy Under Secretary for Infra-
structure Protection.’’; and 
(B) by adding at the end the following new 
paragraph: 
‘‘(3) DEPUTY UNDER SECRETARIES.—The Dep-
uty Under Secretaries referred to in subparagraphs 
(K) and (L) of paragraph (1) shall be appointed by 
the President without the advice and consent of the 
Senate.’’. 
(2) CONTINUATION
IN
OFFICE.—The individ-
uals who hold the positions referred in subpara-
graphs (H), (K), and (L) of paragraph (1) of section 
103(a) the Homeland Security Act of 2002 (as 
amended and added by paragraph (1) of this sub-
section) as of the date of the enactment of this Act 
may continue to hold such positions. 
(c) REPORT.—Not later than 90 days after the date 
of the enactment of this Act, the Under Secretary for Cy-
bersecurity and Infrastructure Protection of the Depart-
ment of Homeland Security shall submit to the Committee 
on Homeland Security of the House of Representatives 
and the Committee on Homeland Security and Govern-
mental Affairs of the Senate a report on the feasibility 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
of becoming an operational component, including an anal-
ysis of alternatives, and if a determination is rendered that 
becoming an operational component is the best option for 
achieving the mission of Cybersecurity and Infrastructure 
Protection, a legislative proposal and implementation plan 
for becoming such an operational component. Such report 
shall also include plans to more effectively carry out the 
cybersecurity mission of Cybersecurity and Infrastructure 
Protection, including expediting information sharing 
agreements. 
SEC. 7. REPORT ON REDUCING CYBERSECURITY RISKS IN 
DHS DATA CENTERS. 
Not later than one year after the date of the enact-
ment of this Act, the Secretary of Homeland Security shall 
submit to the Committee on Homeland Security of the 
House of Representatives and the Committee on Home-
land Security and Governmental Affairs of the Senate a 
report on the feasibility of the Department of Homeland 
Security creating an environment for the reduction in cy-
bersecurity risks in Department data centers, including by 
increasing compartmentalization between systems, and 
providing a mix of security controls between such compart-
ments. 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
SEC. 8. PROHIBITION ON NEW FUNDING. 
No funds are authorized to be appropriated to carry 
out this Act and the amendments made by this Act. This 
Act and such amendments shall be carried out using 
amounts appropriated or otherwise made available for 
such purposes. 
Æ 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6301
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS