IB 
Union Calendar No. 501 
112TH CONGRESS 
2D SESSION 
H. R. 3674 
[Report No. 112–592, Part I] 
To amend the Homeland Security Act of 2002 to make certain improvements 
in the laws relating to cybersecurity, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 15, 2011 
Mr. DANIEL E. LUNGREN of California (for himself, Mr. KING of New York, 
Mr. MCCAUL, Mr. BILIRAKIS, Mrs. MILLER of Michigan, Mr. WALBERG, 
Mr. MARINO, Mr. LONG, Mr. TURNER of New York, Mr. STIVERS, and 
Mr. LANGEVIN) introduced the following bill; which was referred to the 
Committee on Homeland Security, and in addition to the Committees on 
Oversight and Government Reform, Science, Space, and Technology, the 
Judiciary, and Select Intelligence (Permanent Select), for a period to be 
subsequently determined by the Speaker, in each case for consideration 
of such provisions as fall within the jurisdiction of the committee con-
cerned 
JULY 11, 2012 
Reported from the Committee on Homeland Security with an amendment 
[Strike out all after the enacting clause and insert the part printed in italic] 
JULY 11, 2012 
The Committees on Oversight and Government Reform, Science, Space, and 
Technology, the Judiciary, and the Permanent Select Committee on Intel-
ligence discharged; referred to the Committee on Energy and Commerce 
for a period ending not later than September 21, 2012, for consideration 
of such provisions of the bill and amendment as fall within the jurisdic-
tion of that committee pursuant to clause 1(f) of rule X. 
VerDate Mar 15 2010 
22:27 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
SEPTEMBER 21, 2012 
Additional sponsor: Mr. MEEHAN 
SEPTEMBER 21, 2012 
Deleted sponsor: Mr. LANGEVIN (added December 15, 2011; deleted April 25, 
2012) 
SEPTEMBER 21, 2012 
The Committee on Energy and Commerce discharged; committed to the Com-
mittee of the Whole House on the State of the Union and ordered to be 
printed 
[For text of introduced bill, see copy of bill as introduced on December 15, 2011] 
A BILL 
To amend the Homeland Security Act of 2002 to make 
certain improvements in the laws relating to cybersecu-
rity, and for other purposes. 
VerDate Mar 15 2010 
22:27 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Promoting and Enhanc-
ing Cybersecurity and Information Sharing Effectiveness 
Act of 2012’’ or the ‘‘PRECISE Act of 2012’’. 
SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBERSE-
CURITY ACTIVITIES. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 is amended by adding at the end 
the following new sections: 
‘‘SEC. 226. DEPARTMENT OF HOMELAND SECURITY CYBER-
SECURITY ACTIVITIES. 
‘‘(a) IN GENERAL.—The Secretary shall perform nec-
essary activities to help facilitate the protection of Federal 
systems and, solely upon the request of critical infrastruc-
ture owners and operators, assist such critical infrastruc-
ture owners and operators in protecting their critical infra-
structure information systems to include— 
‘‘(1) conduct risk assessments, subject to the 
availability of resources and, solely upon request from 
critical infrastructure owners and operators, critical 
infrastructure information systems; 
‘‘(2) assist in fostering the development, in con-
junction with the National Institute of Standards and 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
Technology and other Federal departments and agen-
cies and the private sector, of essential information 
security technologies and capabilities for protecting 
Federal systems and critical infrastructure informa-
tion systems, including comprehensive protective ca-
pabilities and other technological solutions; 
‘‘(3) assist in efforts to mitigate communications 
and 
information 
technology 
supply 
chain 
vulnerabilities; 
‘‘(4) support nationwide awareness and outreach 
efforts, to include participation in appropriate inter-
agency cybersecurity awareness and education pro-
grams, to educate the public; 
‘‘(5) conduct exercises, simulations, and other ac-
tivities designed to support and evaluate the national 
cyber incident response plan; and 
‘‘(6) subject to the availability of resources and, 
upon request of critical infrastructure owners and op-
erators, provide technical assistance, including send-
ing on-site teams, to such critical infrastructure own-
ers and operators. 
‘‘(b) INTERAGENCY DUTIES.—At the direction of the 
Office of Management and Budget pursuant to subchapter 
II of chapter 35 of title 44, United States Code, the Sec-
retary shall— 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(1) conduct targeted risk assessments and oper-
ational evaluations, in conjunction with the heads of 
other agencies, for Federal systems that may include 
threat, vulnerability, and impact assessments and 
penetration testing; 
‘‘(2) in conjunction with the National Institute 
of Standards and Technology and appropriate Fed-
eral departments and agencies, as well as the private 
sector, provide for the use of consolidated intrusion 
detection, prevention, or other protective capabilities 
and use associated countermeasures for the purpose of 
protecting Federal systems from cybersecurity threats; 
‘‘(3) in conjunction with other agencies and the 
private sector, assess and foster the development of in-
formation security technologies and capabilities for 
use and dissemination throughout the Department of 
Homeland Security and to be made available across 
multiple agencies; 
‘‘(4) designate an entity within the Department 
of Homeland Security to receive reports and informa-
tion about cybersecurity incidents, threats, and 
vulnerabilities affecting Federal systems; and 
‘‘(5) provide incident detection, analysis, mitiga-
tion, and response information and remote or on-site 
technical assistance for Federal systems. 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(c) CYBERSECURITY OPERATIONAL ACTIVITY.— 
‘‘(1) IN GENERAL.—While carrying out the re-
sponsibilities authorized in paragraphs (2) and (3) of 
subsection (b), the Secretary is authorized, notwith-
standing any other provision of law, to acquire, inter-
cept, retain, use, and disclose communications and 
other system traffic that are transiting to or from or 
stored on Federal systems and to deploy counter-
measures with regard to such communications and 
system traffic for cybersecurity purposes if the Sec-
retary certifies that— 
‘‘(A) such acquisitions, interceptions, and 
countermeasures are reasonably necessary for the 
purpose of protecting Federal systems from cy-
bersecurity threats; 
‘‘(B) the content of communications will be 
collected and retained only when the communica-
tion is associated with a known or reasonably 
suspected cybersecurity threat and communica-
tions and system traffic will not be subject to the 
operation of a countermeasure unless associated 
with such threats; 
‘‘(C) information obtained pursuant to ac-
tivities authorized under this subsection will 
only be retained, used, or disclosed to protect 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
Federal systems from cybersecurity threats, miti-
gate against such threats, or, with the approval 
of the Attorney General, for law enforcement 
purposes when the information is evidence of a 
crime which has been, is being, or is about to be 
committed; 
‘‘(D) notice has been provided to users of 
Federal systems concerning the potential for ac-
quisition, interception, retention, use, and disclo-
sure of communications and other system traffic; 
and 
‘‘(E) such activities are implemented pursu-
ant to policies and procedures governing the ac-
quisition, interception, retention, use, and disclo-
sure of communications and other system traffic 
that have been reviewed and approved by the At-
torney General. 
‘‘(2) OBTAINING
ASSISTANCE.—The Secretary 
may enter into contracts or other agreements, or oth-
erwise request and obtain the assistance of, private 
entities that provide electronic communication or cy-
bersecurity services to acquire, intercept, retain, use, 
and disclose communications and other system traffic 
consistent with paragraph (1). 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(3) PERMISSION BY OTHER AGENCIES.—Agen-
cies are authorized to permit the Secretary, or a pri-
vate entity providing assistance to the Secretary 
under paragraph (2), to acquire, intercept, retain, 
use, or disclose communications, system traffic, 
records, or other information transiting to or from or 
stored on a Federal system, notwithstanding any 
other provision of law, for the purpose of protecting 
Federal systems from cybersecurity threats or miti-
gating such threats in connection with activities 
under this subsection. 
‘‘(4) PRIVILEGED COMMUNICATIONS.—No other-
wise privileged communication obtained in accord-
ance with, or in violation of, this subtitle shall lose 
its privileged character. 
‘‘(d) COORDINATION.— 
‘‘(1) COORDINATION WITH OTHER ENTITIES.—In 
carrying out cybersecurity activities subsection (a), 
the Secretary shall coordinate, as appropriate, with— 
‘‘(A) the head of relevant Federal depart-
ments or agencies; 
‘‘(B) representatives of State and local gov-
ernments; 
‘‘(C) owners and operators of critical infra-
structure; 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(D) suppliers of technology for owners and 
operators of critical infrastructure; 
‘‘(E) academia; and 
‘‘(F) international organizations and for-
eign partners. 
‘‘(2) LEAD DHS CYBERSECURITY OFFICIAL.—The 
Secretary shall designate a lead cybersecurity official 
within the Department to provide leadership to the 
cybersecurity activities of the Department and to en-
sure that the Department’s cybersecurity activities 
under this subtitle are coordinated with all other in-
frastructure protection and cyber-related programs 
and activities of the Department, including those of 
any intelligence or law enforcement components or 
entities within the Department. 
‘‘(3) REPORTS TO CONGRESS.—The lead DHS 
cybersecurity official shall make annual reports to the 
appropriate committees of Congress on the coordina-
tion of cyber-related programs across the Department. 
‘‘(e) STRATEGY.—In carrying out the cybersecurity ac-
tivities of the Department under subsection (a), the Sec-
retary shall develop and maintain a strategy that— 
‘‘(1) articulates the actions of the Department 
that are necessary to assure the readiness, reliability, 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
continuity, integrity, and resilience of Federal sys-
tems and critical infrastructure information systems; 
‘‘(2) includes explicit goals and objectives for the 
Department as well as specific timeframes for 
achievement of stated goals and objectives by the De-
partment; 
‘‘(3) fosters the continued superiority and reli-
ability of the United States information technology 
and communications sectors; and 
‘‘(4) ensures that activities of the Department 
are undertaken in a manner that protects statutory 
privacy rights and civil liberties of United States per-
sons. 
‘‘(f) NO RIGHT OR BENEFIT.—The provision of assist-
ance or information to critical infrastructure owners and 
operators, upon request of such critical infrastructure own-
ers and operators, under this section shall be at the discre-
tion of the Secretary and subject to the availability of re-
sources. The provision of certain assistance or information 
to one critical infrastructure owner or and operator pursu-
ant to this section shall not create a right or benefit, sub-
stantive or procedural, to similar assistance or information 
for any other critical infrastructure owner or and operator. 
‘‘(g) PRIVACY OFFICER OVERSIGHT.—The Privacy Of-
ficer of the Department of Homeland Security shall review 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
on an ongoing basis, and prepare, as necessary, privacy 
impact assessments on, the cybersecurity policies, programs, 
and activities of the Department of Homeland Security for 
such purposes as ensuring compliance with all relevant con-
stitutional and legal protections. 
‘‘(h) SAVINGS CLAUSE.—Nothing in this subtitle shall 
be interpreted to— 
‘‘(1) alter or amend the authorities of any Fed-
eral department or agency other than the Department 
of Homeland Security, including the law enforcement 
or intelligence authorities of any such Federal depart-
ment or agency or the authority of any such Federal 
department or agency to protect sources and methods 
and the national security; 
‘‘(2) limit or modify an existing information 
sharing or other relationship; 
‘‘(3) prohibit a new information sharing or other 
relationship; 
‘‘(4) require a new information sharing or other 
relationship between the Federal Government and a 
private sector entity; 
‘‘(5) alter or otherwise limit the authority of any 
Federal department or agency to also undertake any 
activities that the Department of Homeland Security 
is authorized to undertake pursuant to this section; or 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(6) provide additional authority to, or modify 
an existing authority of the Department of Homeland 
Security to control, modify, require, or otherwise di-
rect the cybersecurity efforts of a private-sector entity 
or a component of the Federal Government or a State, 
local, or tribal government. 
‘‘(i) DEFINITIONS.—In this section: 
‘‘(1) The term ‘countermeasure’ means auto-
mated actions with defensive intent to modify or block 
data packets associated with electronic or wire com-
munications, internet traffic, program code, or other 
system traffic transiting to or from or stored on an 
information system for the purpose of protecting the 
information system from cybersecurity threats. 
‘‘(2) The term ‘Federal systems’ means informa-
tion systems owned, operated, leased, or otherwise 
controlled by a Federal department or agency, or on 
behalf of a Federal department or agency, except for 
national security systems or those information sys-
tems under the control of, used by, or storing infor-
mation of the Department of Defense or any element 
of the Intelligence Community, including any infor-
mation systems used or operated by a contractor of 
the Department of Defense or any element of the In-
telligence Community, or other organization on behalf 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
of the Department of Defense or any element of the 
Intelligence Community. 
‘‘(3) The term ‘critical infrastructure informa-
tion systems’ means any information system that is— 
‘‘(A) vital to the functioning of critical in-
frastructure as defined in section 5195c(e) of title 
42, United States Code; or 
‘‘(B) owned or operated by or on behalf of 
a State or local government entity that is nec-
essary to ensure essential government operations 
continue. 
‘‘(4) The term ‘information system’ means any 
equipment or interconnected system or subsystem of 
equipment that is used in the automatic acquisition, 
storage, manipulation, management, movement, con-
trol, display, switching, interchange, transmission, or 
reception of data or information, and includes— 
‘‘(A) computers and computer networks; 
‘‘(B) ancillary equipment; 
‘‘(C) software, firmware, and related proce-
dures; 
‘‘(D) services, including support services; 
and 
‘‘(E) related resources. 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(5) The term ‘national security system’ means 
any information infrastructure (including any tele-
communications system) used or operated by an agen-
cy, by a contractor of an agency, or by another orga-
nization on behalf of an agency— 
‘‘(A) the function, operation, or use of 
which— 
‘‘(i) involves intelligence activities or 
intelligence-related activities; 
‘‘(ii) involves cryptologic activities re-
lated to national security; 
‘‘(iii) involves command and control of 
military forces; 
‘‘(iv) involves equipment that is an in-
tegral part of a weapon or weapons system; 
or 
‘‘(v) is critical to the direct fulfillment 
of military or intelligence missions; 
‘‘(B) that contains information related to 
the activities and other matters set forth in sub-
paragraph (A); or 
‘‘(C) that is protected by procedures estab-
lished for classified, national security, foreign 
policy, intelligence or intelligence-related, or 
other appropriate information. 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘SEC. 227. PERSONNEL AUTHORITIES RELATED TO THE OF-
FICE OF CYBERSECURITY AND COMMUNICA-
TIONS. 
‘‘(a) IN GENERAL.—In order to assure that the De-
partment has the necessary resources to carry out the mis-
sion set forth in section 226, the Secretary may, as nec-
essary, convert competitive service positions, and the in-
cumbents of such positions, within the Office of Cybersecu-
rity and Communications to excepted service, or may estab-
lish new positions within the Office of Cybersecurity and 
Communications in the excepted service, to the extent that 
the Secretary determines such positions are necessary to 
carry out the cybersecurity functions of the Department. 
‘‘(b) COMPENSATION.—The Secretary may— 
‘‘(1) fix the compensation of individuals who 
serve in positions referred to in subsection (a) in rela-
tion to the rates of pay provided for comparable posi-
tions in the Department and subject to the same limi-
tations on maximum rates of pay established for em-
ployees of the Department by law or regulations; and 
‘‘(2) provide additional forms of compensation, 
including benefits, incentives, and allowances, that 
are consistent with and not in excess of the level au-
thorized for comparable positions authorized under 
title 5, United States Code. 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(c) RETENTION
BONUSES.—Notwithstanding any 
other provision of law, the Secretary may pay a retention 
bonus to any employee appointed under this section, if the 
Secretary determines that the bonus is needed to retain es-
sential personnel. Before announcing the payment of a 
bonus under this subsection, the Secretary shall submit a 
written explanation of such determination to the Committee 
on Homeland Security of the House of Representatives and 
the Committee on Homeland Security and Governmental 
Affairs of the Senate. 
‘‘(d) ANNUAL REPORT.—Not later than one year after 
the date of the enactment of this section, and annually 
thereafter, the Secretary shall submit to appropriate Con-
gressional committees a detailed report that includes, for 
the period covered by the report— 
‘‘(1) a discussion the Secretary’s use of the flexi-
ble authority authorized under this section to recruit 
and retain qualified employees; 
‘‘(2) metrics on relevant personnel actions, in-
cluding— 
‘‘(A) the number of qualified employees 
hired by occupation and grade, level, or pay 
band; 
‘‘(B) the total number of veterans hired; 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(C) the number of separations of qualified 
employees; 
‘‘(D) the number of retirements of qualified 
employees; and 
‘‘(E) the number and amounts of recruit-
ment, relocation, and retention incentives paid 
to qualified employees by occupation and grade, 
level, or pay band; and 
‘‘(3) long-term and short-term strategic goals to 
address critical skills deficiencies, including an anal-
ysis of the numbers of and reasons for attrition of em-
ployees and barriers to recruiting and hiring individ-
uals qualified in cybersecurity. 
‘‘SEC. 228. FEDERAL PREEMPTION, EXCLUSIVITY, AND LAW 
ENFORCEMENT AND INTELLIGENCE ACTIVI-
TIES. 
‘‘(a) PREEMPTION.—This subtitle supersedes any stat-
ute of a State or political subdivision of a State that re-
stricts or otherwise expressly regulates the acquisition, 
interception, retention, use, or disclosure of communica-
tions, records, or other information by private entities or 
governmental entities to the extent such statute is incon-
sistent with this subtitle. 
‘‘(b) ADDITIONAL EXCLUSIVE MEANS.—Section 226(c) 
constitutes an additional exclusive means for the domestic 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
interception of wire or electronic communications, in ac-
cordance with the provisions of law codified at section 
1812(b) of title 50, United States Code. 
‘‘(c) LIMITATION.—This subtitle does not authorize the 
Secretary to engage in law enforcement or intelligence ac-
tivities that the Department is not otherwise authorized to 
conduct under existing law.’’. 
(b) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of such Act is amended by inserting after the 
item relating to section 225 the following new items: 
‘‘Sec. 226. Department of Homeland Security cybersecurity activities. 
‘‘Sec. 227. Personnel authorities related to the Office of Cybersecurity and Com-
munications. 
‘‘Sec. 228. Federal preemption, exclusivity, and law enforcement and intelligence 
activities.’’. 
(c) PLAN
FOR EXECUTION
OF AUTHORITIES.—Not 
later than 120 days after the date of the enactment of this 
Act, the Secretary of Homeland Security shall submit to 
the Committee on Homeland Security of the House of Rep-
resentatives and the Committee on Homeland Security and 
Governmental Affairs of the Senate a report containing a 
plan for the execution of the authorities contained in the 
amendment made by subsection (a). 
SEC. 3. DEPARTMENT OF HOMELAND SECURITY CYBERSE-
CURITY INFORMATION SHARING. 
(a) DEPARTMENT OF HOMELAND SECURITY CYBERSE-
CURITY INFORMATION SHARING.— 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
(1) IN GENERAL.—Title II of the Homeland Se-
curity Act of 2002, as amended by section 2, is fur-
ther amended by adding at the end the following: 
‘‘Subtitle E—Department of Home-
land Security Cybersecurity In-
formation Sharing 
‘‘SEC. 241. INFORMATION SHARING. 
‘‘The Secretary shall make appropriate cyber threat 
information obtained by the Department pursuant to title 
XI of the National Security Act of 1947 or other informa-
tion appropriately in the possession of the Department 
available to appropriate owners and operators of critical 
infrastructure on a timely basis consistent with the statu-
tory and other appropriate restrictions on the dissemina-
tion of such information and with the responsibilities of the 
Secretary under this title. 
‘‘SEC. 242. ESTABLISHMENT OF NATIONAL CYBERSECURITY 
AND COMMUNICATIONS INTEGRATION CEN-
TER. 
‘‘(a) ESTABLISHMENT.—There is established within 
the Department the National Cybersecurity and Commu-
nications Integration Center. 
‘‘(b) PURPOSE.—The center established pursuant to 
subsection (a) shall be the primary entity within the De-
partment for sharing timely cyber threat information and 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
exchanging technical assistance, advice, and support with 
appropriate entities pursuant to the Department’s authori-
ties. 
‘‘SEC. 243. BOARD OF ADVISORS. 
‘‘(a) IN GENERAL.—The National Cybersecurity and 
Communications Integration Center shall have a board of 
advisors which shall advise the Secretary on the efficient 
operation of the National Cybersecurity and Communica-
tions Integration Center. 
‘‘(b) COMPOSITION.—The board shall be composed of 
13 members, including the following: 
‘‘(1) Eleven representatives from the critical in-
frastructure sectors enumerated in the National Infra-
structure Protection Plan, of which at least one mem-
ber shall represent a small business interest and at 
least one member shall represent each of the following 
sectors: 
‘‘(A) Banking and finance. 
‘‘(B) Communications. 
‘‘(C) Defense industrial base. 
‘‘(D) Energy, electricity subsector. 
‘‘(E) Energy, oil, and natural gas subsector. 
‘‘(F) Heath care and public health. 
‘‘(G) Information technology. 
‘‘(H) Water. 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(I) Chemical. 
‘‘(2) Two representatives from the privacy and 
civil liberties community. 
‘‘(3) The Chair of the National Council of Infor-
mation Sharing and Analysis Centers. 
‘‘(c) INITIAL APPOINTMENT.—Not later than 30 days 
after the date of the enactment of this subtitle, the Secretary 
of Homeland Security, in consultation with the heads of 
the sector specific agencies of the critical infrastructure sec-
tors enumerated in the National Infrastructure Protection 
Plan, shall appoint the members of the board described 
under subsection (b) from individuals identified by the sec-
tor coordinating councils of the critical infrastructure sec-
tors enumerated in the National Infrastructure Protection 
Plan. 
‘‘(d) TERMS.— 
‘‘(1) CRITICAL
INFRASTRUCTURE
REPRESENTA-
TIVES.—Each member of the board described in sub-
section (b)(1) shall be appointed for a term that is 
not less than one year and not longer than three years 
from the date of the member’s appointment, as deter-
mined by the member’s sector coordinating council. 
‘‘(2) OTHER REPRESENTATIVES.—Each member 
of the board described in subsection (b)(2) or (3) shall 
serve an initial term that is not less than two years 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
and not longer than three years from the date of the 
member’s appointment, and each such member shall 
select the member’s successor. 
‘‘(e) DUTIES.—The board shall— 
‘‘(1) meet not less frequently than quarterly; 
‘‘(2) act as an advocate on behalf of the private 
sector in improving the operations of the National 
Cybersecurity Communications Integration Center; 
and 
‘‘(3) submit to the Secretary and the appropriate 
committees of Congress the annual report described in 
section 247. 
‘‘(f) ACCESS TO INFORMATION.—The members of the 
board shall, subject to the laws and procedures applicable 
to national security background investigations and security 
clearances, be provided with the appropriate security clear-
ances and have access to appropriate information shared 
with the National Cybersecurity and Communications Inte-
gration Center and shall be subject to all of the limitations 
on the use of such information. 
‘‘(g) SUB-BOARDS.—The board shall have the authority 
to constitute such sub-boards, or other advisory groups or 
panels, as may be necessary to assist the board in carrying 
out its functions under this section. 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘SEC. 244. CHARTER. 
‘‘The Secretary shall develop a charter to govern the 
operations and administration of the National Cybersecu-
rity and Communications Integration Center consistent 
with the requirements of title XI of the National Security 
Act of 1947. The charter shall include each of the following: 
‘‘(1) The organizational structure of the National 
Cybersecurity and Communications Integration Cen-
ter, including a delineation of the mission expecta-
tions and responsibilities of the various elements as-
signed to the Center. 
‘‘(2) A mission statement of the National Cyber-
security and Communications Integration Center. 
‘‘(3) A plan that promotes broad participation 
by large, medium, and small business owners and op-
erators of networks or systems in the private sector, 
entities operating critical infrastructure, educational 
institutions, State, tribal, and local governments, and 
the Federal Government. 
‘‘(4) Procedures for making appropriate cyber 
incident information available to outside groups for 
academic research and insurance actuarial purposes. 
‘‘SEC. 245. PARTICIPATION. 
‘‘Not later than 90 days after the date of the enactment 
of this subtitle, the Secretary shall publish the criteria and 
procedures for voluntary participation and voluntary phys-
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
ical collocation by appropriate Federal, State and local gov-
ernment departments, agencies and entities, and private 
sector businesses and organizations within the National Cy-
bersecurity and Communications Integration Center. 
‘‘SEC. 246. ANNUAL REPORT. 
‘‘The board of advisors of the National Cybersecurity 
Communications Integration Center shall submit to the 
Secretary and the appropriate committees of Congress an 
annual report on the status of the National Cybersecurity 
Communications Integration Center and how the Center ac-
complished its purpose under section 242 during the year 
covered by the report. Each such report shall include, for 
the year covered by the report— 
‘‘(1) information on the amount and nature of 
information shared by and through the Center; 
‘‘(2) the number of violations of statutory infor-
mation sharing restrictions and the procedures estab-
lished for the Center and any steps taken by the Cen-
ter to reduce and eliminate such violations; 
‘‘(3) any changes to the Center’s charter as 
agreed upon by the board and the membership; and 
‘‘(4) proposed ways to improve information 
sharing by and through the Center. 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘SEC. 247. AUTHORITY TO ISSUE WARNINGS. 
‘‘The Secretary may, in coordination with appropriate 
Federal departments and agencies, provide advisories, 
alerts, and warnings to relevant companies, targeted sec-
tors, other government entities, or the general public regard-
ing potential cybersecurity threats as appropriate. In 
issuing such an advisory, alert, or warning, the Secretary 
shall not disclose— 
‘‘(1) without the express consent of an entity vol-
untarily sharing information with the Federal Gov-
ernment pursuant to title XI of the National Security 
Act of 1947 and the Federal department or agency 
that initially received such information, any such in-
formation that forms the basis for the advisory, alert, 
or warning or the source of such information; 
‘‘(2) information that is proprietary, business 
sensitive, relates specifically to the submitting person 
or entity, or is otherwise not appropriate for disclo-
sure in the public domain; and 
‘‘(3) any information that is restricted by stat-
ute, rule, or regulation, including information re-
stricted from disclosure under title XI of the National 
Security Act of 1947, and information relating to 
sources and methods and the national security of the 
United States. 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘SEC. 248. DEFINITIONS. 
‘‘In this subtitle: 
‘‘(1) CYBER THREAT INFORMATION.—The term 
‘cyber threat information’ means the information di-
rectly pertaining to a vulnerability of, or threat to, 
a system or network of a government or private enti-
ty, including information pertaining to the protection 
of a system or network from— 
‘‘(A) efforts to degrade, disrupt, or destroy 
such system or network; or 
‘‘(B) efforts to gain unauthorized access to 
a system or network, including efforts to gain 
such unauthorized access to steal or misappro-
priate private or government information. 
‘‘(2) CYBERSECURITY
THREAT.—The term ‘cy-
bersecurity threat’ means a vulnerability of, or threat 
to, a system or network of a government or private 
entity, including— 
‘‘(A) efforts to degrade, disrupt, or destroy 
such system or network; or 
‘‘(B) efforts to gain unauthorized access to 
a system or network, including efforts to gain 
such unauthorized access to steal or misappro-
priate private or government information. 
‘‘SEC. 249. SAVINGS CLAUSE. 
‘‘Nothing in this subtitle shall be interpreted to— 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
‘‘(1) alter or amend the authorities of any Fed-
eral department or agency other than the Department 
of Homeland Security, including the law enforcement 
or intelligence authorities of any such Federal depart-
ment or agency or the authority of any such Federal 
department or agency to protect sources and methods 
and the national security; 
‘‘(2) limit or modify an existing information 
sharing or other relationship; 
‘‘(3) prohibit a new information sharing or other 
relationship; 
‘‘(4) require a new information sharing or other 
relationship between the Federal Government and a 
private sector entity; 
‘‘(5) alter or otherwise limit the authority of any 
Federal department or agency to also undertake any 
activities that the Department of Homeland Security 
is authorized to undertake pursuant to this section; or 
‘‘(6) provide additional authority to, or modify 
an existing authority of the Department of Homeland 
Security to control, modify, require, or otherwise di-
rect the cybersecurity efforts of a private-sector entity 
or a component of the Federal Government or a State, 
local, or tribal government.’’. 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
(2) CLERICAL AMENDMENT.—The table of con-
tents in section 1(b) of such Act, as amended by sec-
tion 2, is further amended by adding at the end of 
the items relating to title II the following new items: 
‘‘Subtitle E—Department of Homeland Security Cybersecurity Information 
Sharing 
‘‘Sec. 241. Information sharing. 
‘‘Sec. 242. Establishment of National Cybersecurity and Communications Inte-
gration Center. 
‘‘Sec. 243. Board of advisors. 
‘‘Sec. 244. Charter. 
‘‘Sec. 245. Participation. 
‘‘Sec. 246. Annual report. 
‘‘Sec. 247. Authority to issue warnings. 
‘‘Sec. 248. Definitions. 
‘‘Sec. 249. Savings clause.’’. 
(b) AUTHORIZATION OF APPROPRIATION FOR THE NA-
TIONAL CYBERSECURITY AND COMMUNICATIONS INTEGRA-
TION CENTER.—There is authorized to be appropriated 
$4,000,000 for each of fiscal years 2013, 2014, and 2015 
for the administration and management of the National 
Cybersecurity and Communications Integration Center. 
SEC. 4. CYBERSECURITY RESEARCH AND DEVELOPMENT. 
(a) IN GENERAL.—Title III of the Homeland Security 
Act of 2002 is amended by adding at the end the following: 
‘‘SEC. 318. CYBERSECURITY RESEARCH AND DEVELOPMENT. 
‘‘(a) IN GENERAL.—The Under Secretary for Science 
and Technology shall support research, development, test-
ing, evaluation, and transition of cybersecurity technology. 
Such support shall include fundamental, long-term research 
to improve the ability of the United States to prevent, pro-
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
tect against, detect, respond to, and recover from acts of 
terrorism and cyber attacks, with an emphasis on research 
and development relevant to attacks that would cause a de-
bilitating impact on national security, national economic 
security, or national public health and safety. 
‘‘(b) ACTIVITIES.—The research and development test-
ing, evaluation, and transition supported under subsection 
(a) shall include work to— 
‘‘(1) advance the development and accelerate the 
deployment of more secure versions of fundamental 
Internet protocols and architectures, including for the 
domain name system and routing protocols; 
‘‘(2) improve, create, and advance the research 
and development of techniques and technologies for 
proactive detection and identification of threats, at-
tacks, and acts of terrorism before they occur; 
‘‘(3) advance technologies for detecting attacks or 
intrusions, including real-time monitoring and real- 
time analytic technologies; 
‘‘(4) improve and create mitigation and recovery 
methodologies, including techniques and policies for 
real-time containment of attacks and development of 
resilient networks and systems; 
‘‘(5) develop and support infrastructure and 
tools to support cybersecurity research and develop-
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS
ment efforts, including modeling, test beds, and data 
sets for assessment of new cybersecurity technologies; 
‘‘(6) assist in the development and support of 
technologies to reduce vulnerabilities in process con-
trol systems; 
‘‘(7) develop and support cyber forensics and at-
tack attribution; 
‘‘(8) test, evaluate, and facilitate the transfer of 
technologies associated with the engineering of less 
vulnerable software and securing the information 
technology software development lifecycle; 
‘‘(9) ensure new cybersecurity technology is sci-
entifically and operationally validated; and 
‘‘(10) facilitate the planning, development, and 
implementation of international cooperative activities 
(as defined in section 317) to address cybersecurity 
and energy infrastructure with foreign public or pri-
vate entities, governmental organizations, businesses 
(including small business concerns and social and 
economically disadvantaged small business concerns 
(as those terms are defined in sections 3 and 8 of the 
Small Business Act (15 U.S.C. 632 and 637) respec-
tively)), federally funded research and development 
centers and universities from countries that may in-
clude Israel, the United Kingdom, Canada, Australia, 
VerDate Mar 15 2010 
22:26 Sep 21, 2012
Jkt 019200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H3674.RH
H3674
TKELLEY on DSK3SPTVN1PROD with BILLS