IB 
Union Calendar No. 44 
114TH CONGRESS 
1ST SESSION H. R. 1560 
[Report No. 114–63] 
To improve cybersecurity in the United States through enhanced sharing 
of information about cybersecurity threats, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 24, 2015 
Mr. NUNES (for himself, Mr. SCHIFF, Mr. WESTMORELAND, and Mr. HIMES) 
introduced the following bill; which was referred to the Select Committee 
on Intelligence (Permanent Select) 
APRIL 13, 2015 
Additional sponsors: Mr. KING of New York, Mr. LOBIONDO, Ms. SEWELL of 
Alabama, Mr. QUIGLEY, and Mr. MURPHY of Florida 
APRIL 13, 2015 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on March 24, 2015] 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
A BILL 
To improve cybersecurity in the United States through en-
hanced sharing of information about cybersecurity 
threats, and for other purposes. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the ‘‘Pro-
tecting Cyber Networks Act’’. 
(b) TABLE OF CONTENTS.—The table of contents of this 
Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Sharing of cyber threat indicators and defensive measures by the Federal 
Government with non-Federal entities. 
Sec. 3. Authorizations for preventing, detecting, analyzing, and mitigating cyber-
security threats. 
Sec. 4. Sharing of cyber threat indicators and defensive measures with appro-
priate Federal entities other than the Department of Defense or 
the National Security Agency. 
Sec. 5. Federal Government liability for violations of privacy or civil liberties. 
Sec. 6. Protection from liability. 
Sec. 7. Oversight of Government activities. 
Sec. 8. Report on cybersecurity threats. 
Sec. 9. Construction and preemption. 
Sec. 10. Conforming amendments. 
Sec. 11. Definitions. 
SEC. 2. SHARING OF CYBER THREAT INDICATORS AND DE-
FENSIVE MEASURES BY THE FEDERAL GOV-
ERNMENT WITH NON-FEDERAL ENTITIES. 
(a) IN GENERAL.—Title I of the National Security Act 
of 1947 (50 U.S.C. 3021 et seq.) is amended by inserting 
after section 110 (50 U.S.C. 3045) the following new sec-
tion: 
‘‘SEC. 111. SHARING OF CYBER THREAT INDICATORS AND 
DEFENSIVE MEASURES BY THE FEDERAL 
GOVERNMENT WITH NON-FEDERAL ENTITIES. 
‘‘(a) SHARING BY THE FEDERAL GOVERNMENT.— 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(2) DEVELOPMENT OF PROCEDURES.—The pro-
cedures developed and promulgated under paragraph 
(1) shall— 
‘‘(A) ensure the Federal Government has 
and maintains the capability to share cyber 
threat indicators in real time consistent with the 
protection of classified information; 
‘‘(B) incorporate, to the greatest extent 
practicable, existing processes and existing roles 
and responsibilities of Federal and non-Federal 
entities for information sharing by the Federal 
Government, including sector-specific informa-
tion sharing and analysis centers; 
‘‘(C) include procedures for notifying non- 
Federal entities that have received a cyber threat 
indicator from a Federal entity in accordance 
with this Act that is known or determined to be 
in error or in contravention of the requirements 
of this section, the Protecting Cyber Networks 
Act, or the amendments made by such Act or an-
other provision of Federal law or policy of such 
error or contravention; 
‘‘(D) include requirements for Federal enti-
ties receiving a cyber threat indicator or defen-
sive measure to implement appropriate security 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
controls to protect against unauthorized access 
to, or acquisition of, such cyber threat indicator 
or defensive measure; 
‘‘(E) include procedures that require Fed-
eral entities, prior to the sharing of a cyber 
threat indicator, to— 
‘‘(i) review such cyber threat indicator 
to assess whether such cyber threat indi-
cator, in contravention of the requirement 
under section 3(d)(2) of the Protecting 
Cyber Networks Act, contains any informa-
tion that such Federal entity knows at the 
time of sharing to be personal information 
of or information identifying a specific per-
son not directly related to a cybersecurity 
threat and remove such information; or 
‘‘(ii) implement a technical capability 
configured to remove or exclude any per-
sonal information of or information identi-
fying a specific person not directly related 
to a cybersecurity threat; and 
‘‘(F) include procedures to promote the effi-
cient granting of security clearances to appro-
priate representatives of non-Federal entities. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(b) DEFINITIONS.—In this section, the terms ‘appro-
priate Federal entities’, ‘cyber threat indicator’, ‘defensive 
measure’, ‘Federal entity’, and ‘non-Federal entity’ have the 
meaning given such terms in section 11 of the Protecting 
Cyber Networks Act.’’. 
(b) SUBMITTAL TO CONGRESS.—Not later than 90 
days after the date of the enactment of this Act, the Director 
of National Intelligence, in consultation with the heads of 
the other appropriate Federal entities, shall submit to Con-
gress the procedures required by section 111(a) of the Na-
tional Security Act of 1947, as inserted by subsection (a) 
of this section. 
(c) TABLE OF CONTENTS AMENDMENT.—The table of 
contents in the first section of the National Security Act 
of 1947 is amended by inserting after the item relating to 
section 110 the following new item: 
‘‘Sec. 111. Sharing of cyber threat indicators and defensive measures by the Fed-
eral Government with non-Federal entities.’’. 
SEC. 3. AUTHORIZATIONS FOR PREVENTING, DETECTING, 
ANALYZING, AND MITIGATING CYBERSECU-
RITY THREATS. 
(a) AUTHORIZATION
FOR PRIVATE-SECTOR DEFEN-
SIVE MONITORING.— 
(1) IN
GENERAL.—Notwithstanding any other 
provision of law, a private entity may, for a cyberse-
curity purpose, monitor— 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(A) an information system of such private 
entity; 
(B) an information system of a non-Federal 
entity or a Federal entity, upon the written au-
thorization of such non-Federal entity or such 
Federal entity; and 
(C) information that is stored on, processed 
by, or transiting an information system mon-
itored by the private entity under this para-
graph. 
(2) CONSTRUCTION.—Nothing in this subsection 
shall be construed to— 
(A) authorize the monitoring of an informa-
tion system, or the use of any information ob-
tained through such monitoring, other than as 
provided in this Act; 
(B) authorize the Federal Government to 
conduct surveillance of any person; or 
(C) limit otherwise lawful activity. 
(b) AUTHORIZATION FOR OPERATION OF DEFENSIVE 
MEASURES.— 
(1) IN GENERAL.—Except as provided in para-
graph (2) and notwithstanding any other provision of 
law, a private entity may, for a cybersecurity pur-
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
pose, operate a defensive measure that is operated on 
and is limited to— 
(A) an information system of such private 
entity to protect the rights or property of the pri-
vate entity; and 
(B) an information system of a non-Federal 
entity or a Federal entity upon written author-
ization of such non-Federal entity or such Fed-
eral entity for operation of such defensive meas-
ure to protect the rights or property of such pri-
vate entity, such non-Federal entity, or such 
Federal entity. 
(2) LIMITATION.—The authority provided in 
paragraph (1) does not include the intentional or 
reckless operation of any defensive measure that de-
stroys, renders unusable or inaccessible (in whole or 
in part), substantially harms, or initiates a new ac-
tion, process, or procedure on an information system 
or information stored on, processed by, or transiting 
such information system not owned by— 
(A) the private entity operating such defen-
sive measure; or 
(B) a non-Federal entity or a Federal enti-
ty that has provided written authorization to 
that private entity for operation of such defen-
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
sive measure on the information system or infor-
mation of the entity in accordance with this sub-
section. 
(3) CONSTRUCTION.—Nothing in this subsection 
shall be construed— 
(A) to authorize the use of a defensive meas-
ure other than as provided in this subsection; or 
(B) to limit otherwise lawful activity. 
(c) AUTHORIZATION
FOR SHARING
OR RECEIVING 
CYBER THREAT INDICATORS OR DEFENSIVE MEASURES.— 
(1) IN GENERAL.—Except as provided in para-
graph (2) and notwithstanding any other provision of 
law, a non-Federal entity may, for a cybersecurity 
purpose and consistent with the requirement under 
subsection (d)(2) to remove personal information of or 
information identifying a specific person not directly 
related to a cybersecurity threat and the protection of 
classified information— 
(A) share a lawfully obtained cyber threat 
indicator or defensive measure with any other 
non-Federal entity or an appropriate Federal 
entity (other than the Department of Defense or 
any component of the Department, including the 
National Security Agency); and 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(D) limit otherwise lawful activity; 
(E) prohibit a non-Federal entity, if au-
thorized by applicable law or regulation other 
than this Act, from sharing a cyber threat indi-
cator or defensive measure with the Department 
of Defense or any component of the Department, 
including the National Security Agency; or 
(F) authorize the Federal Government to 
conduct surveillance of any person. 
(d) PROTECTION AND USE OF INFORMATION.— 
(1) SECURITY OF INFORMATION.—A non-Federal 
entity monitoring an information system, operating a 
defensive measure, or providing or receiving a cyber 
threat indicator or defensive measure under this sec-
tion shall implement an appropriate security control 
to protect against unauthorized access to, or acquisi-
tion of, such cyber threat indicator or defensive meas-
ure. 
(2) REMOVAL OF CERTAIN PERSONAL INFORMA-
TION.—A non-Federal entity sharing a cyber threat 
indicator pursuant to this Act shall, prior to such 
sharing, take reasonable efforts to— 
(A) review such cyber threat indicator to as-
sess whether such cyber threat indicator contains 
any information that the non-Federal entity rea-
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
sonably believes at the time of sharing to be per-
sonal information of or information identifying 
a specific person not directly related to a cyber-
security threat and remove such information; or 
(B) implement a technical capability con-
figured to remove any information contained 
within such indicator that the non-Federal enti-
ty reasonably believes at the time of sharing to 
be personal information of or information identi-
fying a specific person not directly related to a 
cybersecurity threat. 
(3) USE OF CYBER THREAT INDICATORS AND DE-
FENSIVE MEASURES BY NON-FEDERAL ENTITIES.—A 
non-Federal entity may, for a cybersecurity pur-
pose— 
(A) use a cyber threat indicator or defensive 
measure shared or received under this section to 
monitor or operate a defensive measure on— 
(i) an information system of such non- 
Federal entity; or 
(ii) an information system of another 
non-Federal entity or a Federal entity upon 
the written authorization of that other non- 
Federal entity or that Federal entity; and 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(B) otherwise use, retain, and further share 
such cyber threat indicator or defensive measure 
subject to— 
(i) an otherwise lawful restriction 
placed by the sharing non-Federal entity or 
Federal entity on such cyber threat indi-
cator or defensive measure; or 
(ii) an otherwise applicable provision 
of law. 
(4) USE
OF
CYBER
THREAT
INDICATORS
BY 
STATE, TRIBAL, OR LOCAL GOVERNMENT.— 
(A) LAW
ENFORCEMENT
USE.—A State, 
tribal, or local government may use a cyber 
threat indicator shared with such State, tribal, 
or local government for the purposes described in 
clauses (i), (ii), and (iii) of section 4(d)(5)(A). 
(B) EXEMPTION
FROM
DISCLOSURE.—A 
cyber threat indicator shared with a State, trib-
al, or local government under this section shall 
be— 
(i) deemed voluntarily shared informa-
tion; and 
(ii) exempt from disclosure under any 
State, tribal, or local law requiring disclo-
sure of information or records, except as 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
otherwise required by applicable State, trib-
al, or local law requiring disclosure in any 
criminal prosecution. 
(e) NO RIGHT OR BENEFIT.—The sharing of a cyber 
threat indicator with a non-Federal entity under this Act 
shall not create a right or benefit to similar information 
by such non-Federal entity or any other non-Federal entity. 
SEC. 4. SHARING OF CYBER THREAT INDICATORS AND DE-
FENSIVE 
MEASURES 
WITH 
APPROPRIATE 
FEDERAL ENTITIES OTHER THAN THE DE-
PARTMENT OF DEFENSE OR THE NATIONAL 
SECURITY AGENCY. 
(a) REQUIREMENT
FOR
POLICIES
AND
PROCE-
DURES.— 
(1) IN GENERAL.—Section 111 of the National 
Security Act of 1947, as inserted by section 2 of this 
Act, is amended— 
(A) by redesignating subsection (b) as sub-
section (c); and 
(B) by inserting after subsection (a) the fol-
lowing new subsection: 
‘‘(b) POLICIES AND PROCEDURES FOR SHARING WITH 
THE APPROPRIATE FEDERAL ENTITIES OTHER THAN THE 
DEPARTMENT OF DEFENSE OR THE NATIONAL SECURITY 
AGENCY.— 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(1) ESTABLISHMENT.—The President shall de-
velop and submit to Congress policies and procedures 
relating to the receipt of cyber threat indicators and 
defensive measures by the Federal Government. 
‘‘(2) REQUIREMENTS CONCERNING POLICIES AND 
PROCEDURES.—The policies and procedures required 
under paragraph (1) shall— 
‘‘(A) be developed in accordance with the 
privacy and civil liberties guidelines required 
under section 4(b) of the Protecting Cyber Net-
works Act; 
‘‘(B) ensure that— 
‘‘(i) a cyber threat indicator shared by 
a non-Federal entity with an appropriate 
Federal entity (other than the Department 
of Defense or any component of the Depart-
ment, including the National Security 
Agency) pursuant to section 3 of such Act 
is shared in real-time with all of the appro-
priate Federal entities (including all rel-
evant components thereof); 
‘‘(ii) the sharing of such cyber threat 
indicator with appropriate Federal entities 
is not subject to any delay, modification, or 
any other action without good cause that 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
could impede receipt by all of the appro-
priate Federal entities; and 
‘‘(iii) such cyber threat indicator is 
provided to each other Federal entity to 
which such cyber threat indicator is rel-
evant; and 
‘‘(C) ensure there— 
‘‘(i) is an audit capability; and 
‘‘(ii) are appropriate sanctions in 
place for officers, employees, or agents of a 
Federal entity who knowingly and willfully 
use a cyber threat indicator or defense 
measure shared with the Federal Govern-
ment by a non-Federal entity under the 
Protecting Cyber Networks Act other than 
in accordance with this section and such 
Act.’’. 
(2) SUBMISSION.—The President shall submit to 
Congress— 
(A) not later than 90 days after the date of 
the enactment of this Act, interim policies and 
procedures required under section 111(b)(1) of 
the National Security Act of 1947, as inserted by 
paragraph (1) of this section; and 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(B) not later than 180 days after such date, 
final policies and procedures required under such 
section 111(b)(1). 
(b) PRIVACY AND CIVIL LIBERTIES.— 
(1) GUIDELINES OF ATTORNEY GENERAL.—The 
Attorney General, in consultation with the heads of 
the other appropriate Federal agencies and with offi-
cers designated under section 1062 of the Intelligence 
Reform and Terrorism Prevention Act of 2004 (42 
U.S.C. 2000ee–1), shall develop and periodically re-
view guidelines relating to privacy and civil liberties 
that govern the receipt, retention, use, and dissemina-
tion of cyber threat indicators by a Federal entity ob-
tained in accordance with this Act and the amend-
ments made by this Act. 
(2) CONTENT.—The guidelines developed and re-
viewed under paragraph (1) shall, consistent with the 
need to protect information systems from cybersecu-
rity threats and mitigate cybersecurity threats— 
(A) limit the impact on privacy and civil 
liberties of activities by the Federal Government 
under this Act, including guidelines to ensure 
that personal information of or information 
identifying specific persons is properly removed 
from information received, retained, used, or dis-
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
seminated by a Federal entity in accordance 
with this Act or the amendments made by this 
Act; 
(B) limit the receipt, retention, use, and 
dissemination of cyber threat indicators con-
taining personal information of or information 
identifying specific persons, including by estab-
lishing— 
(i) a process for the prompt destruction 
of such information that is known not to be 
directly related to a use for a cybersecurity 
purpose; 
(ii) specific limitations on the length of 
any period in which a cyber threat indi-
cator may be retained; and 
(iii) a process to inform recipients that 
such indicators may only be used for a cy-
bersecurity purpose; 
(C) include requirements to safeguard cyber 
threat indicators containing personal informa-
tion of or identifying specific persons from un-
authorized access or acquisition, including ap-
propriate sanctions for activities by officers, em-
ployees, or agents of the Federal Government in 
contravention of such guidelines; 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(D) include procedures for notifying non- 
Federal entities and Federal entities if informa-
tion received pursuant to this section is known 
or determined by a Federal entity receiving such 
information not to constitute a cyber threat indi-
cator; 
(E) be consistent with any other applicable 
provisions of law and the fair information prac-
tice principles set forth in appendix A of the doc-
ument entitled ‘‘National Strategy for Trusted 
Identities in Cyberspace’’ and published by the 
President in April, 2011; and 
(F) include steps that may be needed so that 
dissemination of cyber threat indicators is con-
sistent with the protection of classified informa-
tion and other sensitive national security infor-
mation. 
(3) SUBMISSION.—The Attorney General shall 
submit to Congress— 
(A) not later than 90 days after the date of 
the enactment of this Act, interim guidelines re-
quired under paragraph (1); and 
(B) not later than 180 days after such date, 
final guidelines required under such paragraph. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(c) NATIONAL CYBER THREAT INTELLIGENCE INTE-
GRATION CENTER.— 
(1) ESTABLISHMENT.—Title I of the National 
Security Act of 1947 (50 U.S.C. 3021 et seq.), as 
amended by section 2 of this Act, is further amend-
ed— 
(A) by redesignating section 119B as section 
119C; and 
(B) by inserting after section 119A the fol-
lowing new section: 
‘‘SEC. 119B. CYBER THREAT INTELLIGENCE INTEGRATION 
CENTER. 
‘‘(a) ESTABLISHMENT.—There is within the Office of 
the Director of National Intelligence a Cyber Threat Intel-
ligence Integration Center. 
‘‘(b) DIRECTOR.—There is a Director of the Cyber 
Threat Intelligence Integration Center, who shall be the 
head of the Cyber Threat Intelligence Integration Center, 
and who shall be appointed by the Director of National In-
telligence. 
‘‘(c) PRIMARY MISSIONS.—The Cyber Threat Intel-
ligence Integration Center shall— 
‘‘(1) serve as the primary organization within 
the Federal Government for analyzing and inte-
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
grating all intelligence possessed or acquired by the 
United States pertaining to cyber threats; 
‘‘(2) ensure that appropriate departments and 
agencies have full access to and receive all-source in-
telligence support needed to execute the cyber threat 
intelligence activities of such agencies and to perform 
independent, alternative analyses; 
‘‘(3) disseminate cyber threat analysis to the 
President, the appropriate departments and agencies 
of the Federal Government, and the appropriate com-
mittees of Congress; 
‘‘(4) coordinate cyber threat intelligence activi-
ties of the departments and agencies of the Federal 
Government; and 
‘‘(5) conduct strategic cyber threat intelligence 
planning for the Federal Government. 
‘‘(d) LIMITATIONS.—The Cyber Threat Intelligence In-
tegration Center shall— 
‘‘(1) have not more than 50 permanent positions; 
‘‘(2) in carrying out the primary missions of the 
Center described in subsection (c), may not augment 
staffing through detailees, assignees, or core contractor 
personnel or enter into any personal services contracts 
to exceed the limitation under paragraph (1); and 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(3) be located in a building owned or operated 
by an element of the intelligence community as of the 
date of the enactment of this section.’’. 
(2) TABLE
OF
CONTENTS
AMENDMENTS.—The 
table of contents in the first section of the National 
Security Act of 1947, as amended by section 2 of this 
Act, is further amended by striking the item relating 
to section 119B and inserting the following new 
items: 
‘‘Sec. 119B. Cyber Threat Intelligence Integration Center. 
‘‘Sec. 119C. National intelligence centers.’’. 
(d) INFORMATION SHARED WITH OR PROVIDED TO 
THE FEDERAL GOVERNMENT.— 
(1) NO
WAIVER
OF
PRIVILEGE
OR
PROTEC-
TION.—The provision of a cyber threat indicator or 
defensive measure to the Federal Government under 
this Act shall not constitute a waiver of any applica-
ble privilege or protection provided by law, including 
trade secret protection. 
(2) 
PROPRIETARY
INFORMATION.—Consistent 
with section 3(c)(2), a cyber threat indicator or defen-
sive measure provided by a non-Federal entity to the 
Federal Government under this Act shall be consid-
ered the commercial, financial, and proprietary infor-
mation of the non-Federal entity that is the origi-
nator of such cyber threat indicator or defensive 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
measure when so designated by such non-Federal enti-
ty or a non-Federal entity acting in accordance with 
the written authorization of the non-Federal entity 
that is the originator of such cyber threat indicator 
or defensive measure. 
(3) EXEMPTION
FROM
DISCLOSURE.—A cyber 
threat indicator or defensive measure provided to the 
Federal Government under this Act shall be— 
(A) deemed voluntarily shared information 
and exempt from disclosure under section 552 of 
title 5, United States Code, and any State, trib-
al, or local law requiring disclosure of informa-
tion or records; and 
(B) withheld, without discretion, from the 
public under section 552(b)(3)(B) of title 5, 
United States Code, and any State, tribal, or 
local provision of law requiring disclosure of in-
formation or records, except as otherwise re-
quired by applicable Federal, State, tribal, or 
local law requiring disclosure in any criminal 
prosecution. 
(4) EX PARTE COMMUNICATIONS.—The provision 
of a cyber threat indicator or defensive measure to the 
Federal Government under this Act shall not be sub-
ject to a rule of any Federal department or agency or 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
any judicial doctrine regarding ex parte communica-
tions with a decision-making official. 
(5) DISCLOSURE, RETENTION, AND USE.— 
(A) AUTHORIZED
ACTIVITIES.—A cyber 
threat indicator or defensive measure provided to 
the Federal Government under this Act may be 
disclosed to, retained by, and used by, consistent 
with otherwise applicable provisions of Federal 
law, any department, agency, component, officer, 
employee, or agent of the Federal Government 
solely for— 
(i) a cybersecurity purpose; 
(ii) the purpose of responding to, pros-
ecuting, or otherwise preventing or miti-
gating a threat of death or serious bodily 
harm or an offense arising out of such a 
threat; 
(iii) the purpose of responding to, or 
otherwise preventing or mitigating, a seri-
ous threat to a minor, including sexual ex-
ploitation and threats to physical safety; or 
(iv) the purpose of preventing, inves-
tigating, disrupting, or prosecuting any of 
the offenses listed in sections 1028, 1029, 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
1030, and 3559(c)(2)(F) and chapters 37 
and 90 of title 18, United States Code. 
(B) 
PROHIBITED
ACTIVITIES.—A 
cyber 
threat indicator or defensive measure provided to 
the Federal Government under this Act shall not 
be disclosed to, retained by, or used by any Fed-
eral department or agency for any use not per-
mitted under subparagraph (A). 
(C) PRIVACY
AND
CIVIL
LIBERTIES.—A 
cyber threat indicator or defensive measure pro-
vided to the Federal Government under this Act 
shall be retained, used, and disseminated by the 
Federal Government in accordance with— 
(i) the policies and procedures relating 
to the receipt of cyber threat indicators and 
defensive measures by the Federal Govern-
ment required by subsection (b) of section 
111 of the National Security Act of 1947, as 
added by subsection (a) of this section; and 
(ii) the privacy and civil liberties 
guidelines required by subsection (b). 
SEC. 5. FEDERAL GOVERNMENT LIABILITY FOR VIOLA-
TIONS OF PRIVACY OR CIVIL LIBERTIES. 
(a) IN GENERAL.—If a department or agency of the 
Federal Government intentionally or willfully violates the 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
privacy and civil liberties guidelines issued by the Attorney 
General under section 4(b), the United States shall be liable 
to a person injured by such violation in an amount equal 
to the sum of— 
(1) the actual damages sustained by the person 
as a result of the violation or $1,000, whichever is 
greater; and 
(2) reasonable attorney fees as determined by the 
court and other litigation costs reasonably incurred 
in any case under this subsection in which the com-
plainant has substantially prevailed. 
(b) VENUE.—An action to enforce liability created 
under this section may be brought in the district court of 
the United States in— 
(1) the district in which the complainant resides; 
(2) the district in which the principal place of 
business of the complainant is located; 
(3) the district in which the department or agen-
cy of the Federal Government that violated such pri-
vacy and civil liberties guidelines is located; or 
(4) the District of Columbia. 
(c) STATUTE OF LIMITATIONS.—No action shall lie 
under this subsection unless such action is commenced not 
later than two years after the date of the violation of the 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
privacy and civil liberties guidelines issued by the Attorney 
General under section 4(b) that is the basis for the action. 
(d) EXCLUSIVE CAUSE OF ACTION.—A cause of action 
under this subsection shall be the exclusive means available 
to a complainant seeking a remedy for a violation by a 
department or agency of the Federal Government under this 
Act. 
SEC. 6. PROTECTION FROM LIABILITY. 
(a) MONITORING
OF INFORMATION SYSTEMS.—No 
cause of action shall lie or be maintained in any court 
against any private entity, and such action shall be 
promptly dismissed, for the monitoring of an information 
system and information under section 3(a) that is con-
ducted in good faith in accordance with this Act and the 
amendments made by this Act. 
(b) SHARING OR RECEIPT OF CYBER THREAT INDICA-
TORS.—No cause of action shall lie or be maintained in 
any court against any non-Federal entity, and such action 
shall be promptly dismissed, for the sharing or receipt of 
a cyber threat indicator or defensive measure under section 
3(c), or a good faith failure to act based on such sharing 
or receipt, if such sharing or receipt is conducted in good 
faith in accordance with this Act and the amendments made 
by this Act. 
(c) WILLFUL MISCONDUCT.— 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(1) RULE OF CONSTRUCTION.—Nothing in this 
section shall be construed— 
(A) to require dismissal of a cause of action 
against a non-Federal entity (including a pri-
vate entity) that has engaged in willful mis-
conduct in the course of conducting activities au-
thorized by this Act or the amendments made by 
this Act; or 
(B) to undermine or limit the availability 
of otherwise applicable common law or statutory 
defenses. 
(2) PROOF OF WILLFUL MISCONDUCT.—In any 
action claiming that subsection (a) or (b) does not 
apply due to willful misconduct described in para-
graph (1), the plaintiff shall have the burden of prov-
ing by clear and convincing evidence the willful mis-
conduct by each non-Federal entity subject to such 
claim and that such willful misconduct proximately 
caused injury to the plaintiff. 
(3) WILLFUL
MISCONDUCT
DEFINED.—In this 
subsection, the term ‘‘willful misconduct’’ means an 
act or omission that is taken— 
(A) intentionally to achieve a wrongful pur-
pose; 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(B) knowingly without legal or factual jus-
tification; and 
(C) in disregard of a known or obvious risk 
that is so great as to make it highly probable 
that the harm will outweigh the benefit. 
SEC. 7. OVERSIGHT OF GOVERNMENT ACTIVITIES. 
(a) BIENNIAL REPORT ON IMPLEMENTATION.— 
(1) IN GENERAL.—Section 111 of the National 
Security Act of 1947, as added by section 2(a) and 
amended by section 4(a) of this Act, is further amend-
ed— 
(A) by redesignating subsection (c) (as re-
designated by such section 4(a)) as subsection 
(d); and 
(B) by inserting after subsection (b) (as in-
serted by such section 4(a)) the following new 
subsection: 
‘‘(c) BIENNIAL REPORT ON IMPLEMENTATION.— 
‘‘(1) IN GENERAL.—Not less frequently than once 
every two years, the Director of National Intelligence, 
in consultation with the heads of the other appro-
priate Federal entities, shall submit to Congress a re-
port concerning the implementation of this section 
and the Protecting Cyber Networks Act. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(2) CONTENTS.—Each report submitted under 
paragraph (1) shall include the following: 
‘‘(A) An assessment of the sufficiency of the 
policies, procedures, and guidelines required by 
this section and section 4 of the Protecting Cyber 
Networks Act in ensuring that cyber threat indi-
cators are shared effectively and responsibly 
within the Federal Government. 
‘‘(B) An assessment of whether the proce-
dures developed under section 3 of such Act com-
ply with the goals described in subparagraphs 
(A), (B), and (C) of subsection (a)(1). 
‘‘(C) An assessment of whether cyber threat 
indicators have been properly classified and an 
accounting of the number of security clearances 
authorized by the Federal Government for the 
purposes of this section and such Act. 
‘‘(D) A review of the type of cyber threat in-
dicators shared with the Federal Government 
under this section and such Act, including the 
following: 
‘‘(i) The degree to which such informa-
tion may impact the privacy and civil lib-
erties of specific persons. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(ii) A quantitative and qualitative 
assessment of the impact of the sharing of 
such cyber threat indicators with the Fed-
eral Government on privacy and civil lib-
erties of specific persons. 
‘‘(iii) The adequacy of any steps taken 
by the Federal Government to reduce such 
impact. 
‘‘(E) A review of actions taken by the Fed-
eral Government based on cyber threat indicators 
shared with the Federal Government under this 
section or such Act, including the appropriate-
ness of any subsequent use or dissemination of 
such cyber threat indicators by a Federal entity 
under this section or section 4 of such Act. 
‘‘(F) A description of any significant viola-
tions of the requirements of this section or such 
Act by the Federal Government— 
‘‘(i) an assessment of all reports of offi-
cers, employees, and agents of the Federal 
Government misusing information provided 
to the Federal Government under the Pro-
tecting Cyber Networks Act or this section, 
without regard to whether the misuse was 
knowing or wilful; and 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(ii) an assessment of all disciplinary 
actions taken against such officers, employ-
ees, and agents. 
‘‘(G) A summary of the number and type of 
non-Federal entities that received classified cyber 
threat indicators from the Federal Government 
under this section or such Act and an evaluation 
of the risks and benefits of sharing such cyber 
threat indicators. 
‘‘(H) An assessment of any personal infor-
mation of or information identifying a specific 
person not directly related to a cybersecurity 
threat that— 
‘‘(i) was shared by a non-Federal enti-
ty with the Federal Government under this 
Act in contravention of section 3(d)(2); or 
‘‘(ii) was shared within the Federal 
Government under this Act in contravention 
of the guidelines required by section 4(b). 
‘‘(3) RECOMMENDATIONS.—Each report sub-
mitted under paragraph (1) may include such rec-
ommendations as the heads of the appropriate Federal 
entities may have for improvements or modifications 
to the authorities and processes under this section or 
such Act. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(4) FORM OF REPORT.—Each report required 
by paragraph (1) shall be submitted in unclassified 
form, but may include a classified annex. 
‘‘(5) PUBLIC
AVAILABILITY
OF
REPORTS.—The 
Director of National Intelligence shall make publicly 
available the unclassified portion of each report re-
quired by paragraph (1).’’. 
(2) INITIAL REPORT.—The first report required 
under subsection (c) of section 111 of the National Se-
curity Act of 1947, as inserted by paragraph (1) of 
this subsection, shall be submitted not later than one 
year after the date of the enactment of this Act. 
(b) REPORTS ON PRIVACY AND CIVIL LIBERTIES.— 
(1) BIENNIAL REPORT FROM PRIVACY AND CIVIL 
LIBERTIES OVERSIGHT BOARD.— 
(A) IN GENERAL.—Section 1061(e) of the 
Intelligence Reform and Terrorism Prevention 
Act of 2004 (42 U.S.C. 2000ee(e)) is amended by 
adding at the end the following new paragraph: 
‘‘(3) BIENNIAL REPORT ON CERTAIN CYBER AC-
TIVITIES.— 
‘‘(A) REPORT
REQUIRED.—The Privacy 
and Civil Liberties Oversight Board shall bienni-
ally submit to Congress and the President a re-
port containing— 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(i) an assessment of the privacy and 
civil liberties impact of the activities car-
ried out under the Protecting Cyber Net-
works Act and the amendments made by 
such Act; and 
‘‘(ii) an assessment of the sufficiency of 
the policies, procedures, and guidelines es-
tablished pursuant to section 4 of the Pro-
tecting Cyber Networks Act and the amend-
ments made by such section 4 in addressing 
privacy and civil liberties concerns. 
‘‘(B) 
RECOMMENDATIONS.—Each 
report 
submitted under this paragraph may include 
such recommendations as the Privacy and Civil 
Liberties Oversight Board may have for improve-
ments or modifications to the authorities under 
the Protecting Cyber Networks Act or the amend-
ments made by such Act. 
‘‘(C) FORM.—Each report required under 
this paragraph shall be submitted in unclassified 
form, but may include a classified annex. 
‘‘(D) PUBLIC AVAILABILITY OF REPORTS.— 
The Privacy and Civil Liberties Oversight Board 
shall make publicly available the unclassified 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
portion of each report required by subparagraph 
(A).’’. 
(B) INITIAL REPORT.—The first report re-
quired under paragraph (3) of section 1061(e) of 
the Intelligence Reform and Terrorism Preven-
tion Act of 2004 (42 U.S.C. 2000ee(e)), as added 
by subparagraph (A) of this paragraph, shall be 
submitted not later than 2 years after the date 
of the enactment of this Act. 
(2) BIENNIAL
REPORT
OF
INSPECTORS
GEN-
ERAL.— 
(A) IN GENERAL.—Not later than 2 years 
after the date of the enactment of this Act and 
not less frequently than once every 2 years there-
after, the Inspector General of the Department of 
Homeland Security, the Inspector General of the 
Intelligence Community, the Inspector General of 
the Department of Justice, and the Inspector 
General of the Department of Defense, in con-
sultation with the Council of Inspectors General 
on Financial Oversight, shall jointly submit to 
Congress a report on the receipt, use, and dis-
semination of cyber threat indicators and defen-
sive measures that have been shared with Federal 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
entities under this Act and the amendments 
made by this Act. 
(B) CONTENTS.—Each report submitted 
under subparagraph (A) shall include the fol-
lowing: 
(i) A review of the types of cyber threat 
indicators shared with Federal entities. 
(ii) A review of the actions taken by 
Federal entities as a result of the receipt of 
such cyber threat indicators. 
(iii) A list of Federal entities receiving 
such cyber threat indicators. 
(iv) A review of the sharing of such 
cyber threat indicators among Federal enti-
ties to identify inappropriate barriers to 
sharing information. 
(C) RECOMMENDATIONS.—Each report sub-
mitted under this paragraph may include such 
recommendations as the Inspectors General re-
ferred to in subparagraph (A) may have for im-
provements or modifications to the authorities 
under this Act or the amendments made by this 
Act. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(D) FORM.—Each report required under 
this paragraph shall be submitted in unclassified 
form, but may include a classified annex. 
(E) PUBLIC AVAILABILITY OF REPORTS.— 
The Inspector General of the Department of 
Homeland Security, the Inspector General of the 
Intelligence Community, the Inspector General of 
the Department of Justice, and the Inspector 
General of the Department of Defense shall make 
publicly available the unclassified portion of 
each report required under subparagraph (A). 
SEC. 8. REPORT ON CYBERSECURITY THREATS. 
(a) REPORT REQUIRED.—Not later than 180 days 
after the date of the enactment of this Act, the Director of 
National Intelligence, in consultation with the heads of 
other appropriate elements of the intelligence community, 
shall submit to the Select Committee on Intelligence of the 
Senate and the Permanent Select Committee on Intelligence 
of the House of Representatives a report on cybersecurity 
threats, including cyber attacks, theft, and data breaches. 
(b) CONTENTS.—The report required by subsection (a) 
shall include the following: 
(1) An assessment of— 
(A) the current intelligence sharing and co-
operation relationships of the United States with 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
other countries regarding cybersecurity threats 
(including 
cyber 
attacks, 
theft, 
and 
data 
breaches) directed against the United States that 
threaten the United States national security in-
terests, economy, and intellectual property; and 
(B) the relative utility of such relationships, 
which elements of the intelligence community 
participate in such relationships, and whether 
and how such relationships could be improved. 
(2) A list and an assessment of the countries and 
non-state actors that are the primary threats of car-
rying out a cybersecurity threat (including a cyber 
attack, theft, or data breach) against the United 
States and that threaten the United States national 
security, economy, and intellectual property. 
(3) A description of the extent to which the capa-
bilities of the United States Government to respond to 
or prevent cybersecurity threats (including cyber at-
tacks, theft, or data breaches) directed against the 
United States private sector are degraded by a delay 
in the prompt notification by private entities of such 
threats or cyber attacks, theft, and breaches. 
(4) An assessment of additional technologies or 
capabilities that would enhance the ability of the 
United States to prevent and to respond to cybersecu-
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
rity threats (including cyber attacks, theft, and data 
breaches). 
(5) An assessment of any technologies or prac-
tices utilized by the private sector that could be rap-
idly fielded to assist the intelligence community in 
preventing and responding to cybersecurity threats. 
(c) FORM OF REPORT.—The report required by sub-
section (a) shall be submitted in unclassified form, but may 
include a classified annex. 
(d) PUBLIC AVAILABILITY OF REPORT.—The Director 
of National Intelligence shall make publicly available the 
unclassified portion of the report required by subsection (a). 
(e) INTELLIGENCE COMMUNITY DEFINED.—In this sec-
tion, the term ‘‘intelligence community’’ has the meaning 
given that term in section 3 of the National Security Act 
of 1947 (50 U.S.C. 3003). 
SEC. 9. CONSTRUCTION AND PREEMPTION. 
(a) PROHIBITION OF SURVEILLANCE.—Nothing in this 
Act or the amendments made by this Act shall be construed 
to authorize the Department of Defense or the National Se-
curity Agency or any other element of the intelligence com-
munity to target a person for surveillance. 
(b) OTHERWISE LAWFUL DISCLOSURES.—Nothing in 
this Act or the amendments made by this Act shall be con-
strued to limit or prohibit— 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(1) otherwise lawful disclosures of communica-
tions, records, or other information, including report-
ing of known or suspected criminal activity, by a 
non-Federal entity to any other non-Federal entity or 
the Federal Government; or 
(2) any otherwise lawful use of such disclosures 
by any entity of the Federal government, without re-
gard to whether such otherwise lawful disclosures du-
plicate or replicate disclosures made under this Act. 
(c) WHISTLE BLOWER PROTECTIONS.—Nothing in 
this Act or the amendments made by this Act shall be con-
strued to prohibit or limit the disclosure of information pro-
tected under section 2302(b)(8) of title 5, United States 
Code (governing disclosures of illegality, waste, fraud, 
abuse, or public health or safety threats), section 7211 of 
title 5, United States Code (governing disclosures to Con-
gress), section 1034 of title 10, United States Code (gov-
erning disclosure to Congress by members of the military), 
or any similar provision of Federal or State law.. 
(d) PROTECTION OF SOURCES AND METHODS.—Noth-
ing in this Act or the amendments made by this Act shall 
be construed— 
(1) as creating any immunity against, or other-
wise affecting, any action brought by the Federal 
Government, or any department or agency thereof, to 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
enforce any law, executive order, or procedure gov-
erning the appropriate handling, disclosure, or use of 
classified information; 
(2) to affect the conduct of authorized law en-
forcement or intelligence activities; or 
(3) to modify the authority of the President or 
a department or agency of the Federal Government to 
protect and control the dissemination of classified in-
formation, intelligence sources and methods, and the 
national security of the United States. 
(e) RELATIONSHIP TO OTHER LAWS.—Nothing in this 
Act or the amendments made by this Act shall be construed 
to affect any requirement under any other provision of law 
for a non-Federal entity to provide information to the Fed-
eral Government. 
(f) INFORMATION SHARING RELATIONSHIPS.—Nothing 
in this Act or the amendments made by this Act shall be 
construed— 
(1) to limit or modify an existing information- 
sharing relationship; 
(2) to prohibit a new information-sharing rela-
tionship; or 
(3) to require a new information-sharing rela-
tionship between any non-Federal entity and the Fed-
eral Government. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(g) PRESERVATION
OF CONTRACTUAL OBLIGATIONS 
AND RIGHTS.—Nothing in this Act or the amendments 
made by this Act shall be construed— 
(1) to amend, repeal, or supersede any current or 
future contractual agreement, terms of service agree-
ment, or other contractual relationship between any 
non-Federal entities, or between any non-Federal en-
tity and a Federal entity; or 
(2) to abrogate trade secret or intellectual prop-
erty rights of any non-Federal entity or Federal enti-
ty. 
(h) ANTI-TASKING RESTRICTION.—Nothing in this Act 
or the amendments made by this Act shall be construed to 
permit the Federal Government— 
(1) to require a non-Federal entity to provide in-
formation to the Federal Government; 
(2) to condition the sharing of a cyber threat in-
dicator with a non-Federal entity on such non-Fed-
eral entity’s provision of a cyber threat indicator to 
the Federal Government; or 
(3) to condition the award of any Federal grant, 
contract, or purchase on the provision of a cyber 
threat indicator to a Federal entity. 
(i) NO LIABILITY FOR NON-PARTICIPATION.—Nothing 
in this Act or the amendments made by this Act shall be 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
construed to subject any non-Federal entity to liability for 
choosing not to engage in a voluntary activiy authorized 
in this Act and the amendments made by this Act. 
(j) USE AND RETENTION OF INFORMATION.—Nothing 
in this Act or the amendments made by this Act shall be 
construed to authorize, or to modify any existing authority 
of, a department or agency of the Federal Government to 
retain or use any information shared under this Act or the 
amendments made by this Act for any use other than per-
mitted in this Act or the amendments made by this Act. 
(k) FEDERAL PREEMPTION.— 
(1) IN GENERAL.—This Act and the amendments 
made by this Act supersede any statute or other pro-
vision of law of a State or political subdivision of a 
State that restricts or otherwise expressly regulates an 
activity authorized under this Act or the amendments 
made by this Act. 
(2) STATE LAW ENFORCEMENT.—Nothing in this 
Act or the amendments made by this Act shall be con-
strued to supersede any statute or other provision of 
law of a State or political subdivision of a State con-
cerning the use of authorized law enforcement prac-
tices and procedures. 
(l) REGULATORY AUTHORITY.—Nothing in this Act or 
the amendments made by this Act shall be construed— 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(1) to authorize the promulgation of any regula-
tions not specifically authorized by this Act or the 
amendments made by this Act; 
(2) to establish any regulatory authority not spe-
cifically established under this Act or the amendments 
made by this Act; or 
(3) to authorize regulatory actions that would 
duplicate or conflict with regulatory requirements, 
mandatory standards, or related processes under an-
other provision of Federal law. 
SEC. 10. CONFORMING AMENDMENTS. 
Section 552(b) of title 5, United States Code, is amend-
ed— 
(1) in paragraph (8), by striking ‘‘or’’ at the 
end; 
(2) in paragraph (9), by striking ‘‘wells.’’ and 
inserting ‘‘wells; or’’; and 
(3) by inserting after paragraph (9) the fol-
lowing: 
‘‘(10) information shared with or provided to the 
Federal Government pursuant to the Protecting Cyber 
Networks Act or the amendments made by such Act.’’. 
SEC. 11. DEFINITIONS. 
In this Act: 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(1) AGENCY.—The term ‘‘agency’’ has the mean-
ing given the term in section 3502 of title 44, United 
States Code. 
(2) APPROPRIATE
FEDERAL
ENTITIES.—The 
term ‘‘appropriate Federal entities’’ means the fol-
lowing: 
(A) The Department of Commerce. 
(B) The Department of Defense. 
(C) The Department of Energy. 
(D) The Department of Homeland Security. 
(E) The Department of Justice. 
(F) The Department of the Treasury. 
(G) The Office of the Director of National 
Intelligence. 
(3) CYBERSECURITY PURPOSE.—The term ‘‘cy-
bersecurity purpose’’ means the purpose of protecting 
(including through the use of a defensive measure) an 
information system or information that is stored on, 
processed by, or transiting an information system 
from a cybersecurity threat or security vulnerability 
or identifying the source of a cybersecurity threat. 
(4) CYBERSECURITY THREAT.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘cybersecurity 
threat’’ means an action, not protected by the 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
first amendment to the Constitution of the 
United States, on or through an information sys-
tem that may result in an unauthorized effort to 
adversely impact the security, confidentiality, 
integrity, or availability of an information sys-
tem or information that is stored on, processed 
by, or transiting an information system. 
(B) EXCLUSION.—The term ‘‘cybersecurity 
threat’’ does not include any action that solely 
involves a violation of a consumer term of service 
or a consumer licensing agreement. 
(5) CYBER
THREAT
INDICATOR.—The term 
‘‘cyber threat indicator’’ means information or a 
physical object that is necessary to describe or iden-
tify— 
(A) malicious reconnaissance, including 
anomalous patterns of communications that ap-
pear to be transmitted for the purpose of gath-
ering technical information related to a cyberse-
curity threat or security vulnerability; 
(B) a method of defeating a security control 
or exploitation of a security vulnerability; 
(C) a security vulnerability, including 
anomalous activity that appears to indicate the 
existence of a security vulnerability; 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(D) a method of causing a user with legiti-
mate access to an information system or infor-
mation that is stored on, processed by, or 
transiting an information system to unwittingly 
enable the defeat of a security control or exploi-
tation of a security vulnerability; 
(E) malicious cyber command and control; 
(F) the actual or potential harm caused by 
an incident, including a description of the infor-
mation exfiltrated as a result of a particular cy-
bersecurity threat; or 
(G) any other attribute of a cybersecurity 
threat, if disclosure of such attribute is not other-
wise prohibited by law. 
(6) DEFENSIVE MEASURE.—The term ‘‘defensive 
measure’’ means an action, device, procedure, tech-
nique, or other measure executed on an information 
system or information that is stored on, processed by, 
or transiting an information system that prevents or 
mitigates a known or suspected cybersecurity threat 
or security vulnerability. 
(7) FEDERAL ENTITY.—The term ‘‘Federal enti-
ty’’ means a department or agency of the United 
States or any component of such department or agen-
cy. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(8) INFORMATION SYSTEM.—The term ‘‘informa-
tion system’’— 
(A) has the meaning given the term in sec-
tion 3502 of title 44, United States Code; and 
(B) includes industrial control systems, 
such as supervisory control and data acquisition 
systems, distributed control systems, and pro-
grammable logic controllers. 
(9) LOCAL GOVERNMENT.—The term ‘‘local gov-
ernment’’ means any borough, city, county, parish, 
town, township, village, or other political subdivision 
of a State. 
(10) MALICIOUS
CYBER
COMMAND
AND
CON-
TROL.—The term ‘‘malicious cyber command and 
control’’ means a method for unauthorized remote 
identification of, access to, or use of, an information 
system or information that is stored on, processed by, 
or transiting an information system. 
(11) MALICIOUS
RECONNAISSANCE.—The term 
‘‘malicious reconnaissance’’ means a method for ac-
tively probing or passively monitoring an informa-
tion system for the purpose of discerning security 
vulnerabilities of the information system, if such 
method is associated with a known or suspected cyber-
security threat. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(12) MONITOR.—The term ‘‘monitor’’ means to 
acquire, identify, scan, or otherwise possess informa-
tion that is stored on, processed by, or transiting an 
information system. 
(13) NON-FEDERAL ENTITY.— 
(A) IN GENERAL.—Except as otherwise pro-
vided in this paragraph, the term ‘‘non-Federal 
entity’’ means any private entity, non-Federal 
government department or agency, or State, trib-
al, or local government (including a political 
subdivision, department, officer, employee, or 
agent thereof). 
(B) INCLUSIONS.—The term ‘‘non-Federal 
entity’’ includes a government department or 
agency (including an officer, employee, or agent 
thereof) of the District of Columbia, the Com-
monwealth of Puerto Rico, the Virgin Islands, 
Guam, American Samoa, the Northern Mariana 
Islands, and any other territory or possession of 
the United States. 
(C) EXCLUSION.—The term ‘‘non-Federal 
entity’’ does not include a foreign power or 
known agent of a foreign power, as both terms 
are defined in section 101 of the Foreign Intel-
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
ligence Surveillance Act of 1978 (50 U.S.C. 
1801). 
(14) PRIVATE ENTITY.— 
(A) IN GENERAL.—Except as otherwise pro-
vided in this paragraph, the term ‘‘private enti-
ty’’ means any person or private group, organi-
zation, proprietorship, partnership, trust, cooper-
ative, corporation, or other commercial or non-
profit entity, including an officer, employee, or 
agent thereof. 
(B) INCLUSION.—The term ‘‘private entity’’ 
includes a component of a State, tribal, or local 
government performing electric utility services. 
(C) EXCLUSION.—The term ‘‘private entity’’ 
does not include a foreign power as defined in 
section 101 of the Foreign Intelligence Surveil-
lance Act of 1978 (50 U.S.C. 1801). 
(15) REAL TIME; REAL-TIME.—The terms ‘‘real 
time’’ and ‘‘real-time’’ mean a process by which an 
automated, 
machine-to-machine 
system 
processes 
cyber threat indicators such that the time in which 
the occurrence of an event and the reporting or re-
cording of it are as simultaneous as technologically 
and operationally practicable. 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
(16) SECURITY CONTROL.—The term ‘‘security 
control’’ means the management, operational, and 
technical controls used to protect against an unau-
thorized effort to adversely impact the security, con-
fidentiality, integrity, and availability of an infor-
mation system or its information. 
(17) SECURITY VULNERABILITY.—The term ‘‘se-
curity vulnerability’’ means any attribute of hard-
ware, software, process, or procedure that could enable 
or facilitate the defeat of a security control. 
(18) TRIBAL.—The term ‘‘tribal’’ has the mean-
ing given the term ‘‘Indian tribe’’ in section 4 of the 
Indian Self-Determination and Education Assistance 
Act (25 U.S.C. 450b). 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6203
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS
Union Calendar No. 44 
114TH CONGRESS 
1ST SESSION 
H. R. 1560 
[Report No. 114–63] 
A BILL 
To improve cybersecurity in the United States 
through enhanced sharing of information about 
cybersecurity threats, and for other purposes. 
APRIL 13, 2015 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
22:46 Apr 13, 2015
Jkt 049200
PO 00000
Frm 00054
Fmt 6651
Sfmt 6651
E:\BILLS\H1560.RH
H1560
mstockstill on DSK4VPTVN1PROD with BILLS