SEC. 2. DUTIES OF THE SECRETARY OF HOMELAND SECU-
RITY RELATED TO INFORMATION SECURITY. 
Section 3553(b)(6) of title 44, United States Code, 
is amended by striking subparagraphs (B), (C), and (D) 
and inserting the following: 
‘‘(B) operating consolidated intrusion de-
tection, prevention, or other protective capabili-
ties and use of associated countermeasures for 
the purpose of protecting agency information 
and information systems from information secu-
rity threats; 
‘‘(C) providing incident detection, analysis, 
mitigation, and response information and re-
mote or onsite technical assistance to the head 
of an agency; 
‘‘(D) compiling and analyzing data on 
agency information security; 
‘‘(E) developing and conducting targeted 
risk assessments and operational evaluations for 
agency information and information systems in 
consultation with the heads of other agencies or 
governmental and private entities that own and 
operate such systems, that may include threat, 
vulnerability, and impact assessments; 
‘‘(F) in conjunction with other agencies 
and the private sector, assessing and fostering 
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS
the development of information security tech-
nologies and capabilities for use across multiple 
agencies; and 
‘‘(G) coordinating with appropriate agen-
cies and officials to ensure, to the maximum ex-
tent feasible, that policies and directives issued 
under paragraph (2) are complementary with— 
‘‘(i) standards and guidelines devel-
oped for national security systems; and 
‘‘(ii) policies and directives issued by 
the Secretary of Defense and the Director 
of National Intelligence under subsection 
(e)(1); and’’. 
SEC. 3. COMMUNICATIONS AND SYSTEM TRAFFIC AND DI-
RECTION TO AGENCIES. 
Section 3553 of title 44, United States Code, is 
amended by adding at the end the following: 
‘‘(h) COMMUNICATIONS AND SYSTEMS TRAFFIC.— 
‘‘(1) IN GENERAL.— 
‘‘(A) ACQUISITION BY THE SECRETARY.— 
Notwithstanding any other provision of law and 
subject to subparagraph (B), in carrying out 
the responsibilities under subparagraphs (B), 
(C), and (E) of subsection (b)(6), if the Sec-
retary makes a certification described in para-
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS
graph (2), the Secretary may acquire, intercept, 
retain, use, and disclose communications and 
other system traffic that are transiting to or 
from or stored on agency information systems 
and deploy countermeasures with regard to the 
communications and system traffic. 
‘‘(B) EXCEPTION.—The authorities of the 
Secretary under this subsection shall not apply 
to a communication or other system traffic that 
is transiting to or from or stored on a system 
described in paragraph (2) or (3) of subsection 
(e). 
‘‘(C) DISCLOSURE
BY
FEDERAL
AGENCY 
HEADS.—The head of a Federal agency or de-
partment is authorized to disclose to the Sec-
retary or a private entity providing assistance 
to the Secretary under paragraph (A), informa-
tion traveling to or from or stored on an agency 
information system, notwithstanding any other 
law that would otherwise restrict or prevent 
agency heads from disclosing such information 
to the Secretary. 
‘‘(2) CERTIFICATION.—A certification described 
in this paragraph is a certification by the Secretary 
that— 
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS
‘‘(A) the acquisitions, interceptions, and 
other countermeasures are reasonably necessary 
for the purpose of protecting agency informa-
tion systems from information security threats; 
‘‘(B) the content of communications will be 
retained only if the communication is associated 
with a known or reasonably suspected informa-
tion security threat, and communications and 
system traffic will not be subject to the oper-
ation of a countermeasure unless associated 
with the threats; 
‘‘(C) information obtained under activities 
authorized under this subsection will only be re-
tained, used, or disclosed to protect agency in-
formation systems from information security 
threats, mitigate against such threats, or, with 
the approval of the Attorney General, for law 
enforcement purposes when the information is 
evidence of a crime which has been, is being, or 
is about to be committed; 
‘‘(D) notice has been provided to users of 
agency information systems concerning the po-
tential for acquisition, interception, retention, 
use, and disclosure of communications and 
other system traffic; and 
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS
‘‘(E) the activities are implemented pursu-
ant to policies and procedures governing the ac-
quisition, interception, retention, use, and dis-
closure of communications and other system 
traffic that have been reviewed and approved by 
the Attorney General. 
‘‘(3) PRIVATE ENTITIES.—The Secretary may 
enter into contracts or other agreements, or other-
wise request and obtain the assistance of, private en-
tities that provide electronic communication or infor-
mation security services to acquire, intercept, retain, 
use, and disclose communications and other system 
traffic in accordance with this subsection. 
‘‘(4) NO CAUSE OF ACTION.—No cause of ac-
tion shall exist against a private entity for assistance 
provided to the Secretary in accordance with para-
graph (3). 
‘‘(i) DIRECTION TO AGENCIES.— 
‘‘(1) AUTHORITY.— 
‘‘(A) IN GENERAL.—Notwithstanding sec-
tion 3554, and subject to subparagraph (B), in 
response to a known or reasonably suspected in-
formation security threat, vulnerability, or inci-
dent that represents a substantial threat to the 
information security of an agency, the Secretary 
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS
may issue a directive to the head of an agency 
to take any lawful action with respect to the op-
eration of the information system, including 
such systems owned or operated by another en-
tity on behalf of an agency, that collects, proc-
esses, stores, transmits, disseminates, or other-
wise maintains agency information, for the pur-
pose of protecting the information system from, 
or mitigating, an information security threat. 
‘‘(B) EXCEPTION.—The authorities of the 
Secretary under this subsection shall not apply 
to a system described in paragraph (2) or (3) 
of subsection (e). 
‘‘(2) PROCEDURES FOR USE OF AUTHORITY.— 
The Secretary shall— 
‘‘(A) in coordination with the Director and 
in consultation with Federal contractors, as ap-
propriate, establish procedures governing the 
circumstances under which a directive may be 
issued under this subsection, which shall in-
clude— 
‘‘(i) thresholds and other criteria; 
‘‘(ii) privacy and civil liberties protec-
tions; and 
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS
‘‘(iii) providing notice to potentially 
affected third parties; 
‘‘(B) specify the reasons for the required 
action and the duration of the directive; 
‘‘(C) minimize the impact of a directive 
under this subsection by— 
‘‘(i) adopting the least intrusive 
means possible under the circumstances to 
secure the agency information systems; 
and 
‘‘(ii) limiting directives to the shortest 
period practicable; and 
‘‘(D) notify the Director and the head of 
any affected agency immediately upon the 
issuance of a directive under this subsection. 
‘‘(3) IMMINENT THREATS.— 
‘‘(A) IN GENERAL.—If the Secretary deter-
mines that there is an imminent threat to agen-
cy information systems and a directive under 
this subsection is not reasonably likely to result 
in a timely response to the threat, the Secretary 
may authorize the use of protective capabilities 
under the control of the Secretary for commu-
nications or other system traffic transiting to or 
from or stored on an agency information system 
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS
without prior consultation with the affected 
agency for the purpose of ensuring the security 
of the information or information system or 
other agency information systems. 
‘‘(B) LIMITATION ON DELEGATION.—The 
authority under this paragraph may not be del-
egated to an official in a position lower than an 
Assistant Secretary of the Department of 
Homeland Security. 
‘‘(C) NOTICE.—The Secretary shall imme-
diately notify the Director and the head and 
chief information officer (or equivalent official) 
of each affected agency of— 
‘‘(i) any action taken under this sub-
section; and 
‘‘(ii) the reasons for and duration and 
nature of the action. 
‘‘(D) OTHER LAW.—Any action of the Sec-
retary under this paragraph shall be consistent 
with applicable law. 
‘‘(4) LIMITATION.—The Secretary may direct 
or authorize lawful action or protective capability 
under this subsection only to— 
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS
‘‘(A) protect agency information from un-
authorized access, use, disclosure, disruption, 
modification, or destruction; or 
‘‘(B) require the remediation of or protect 
against identified information security risks 
with respect to— 
‘‘(i) information collected or main-
tained by or on behalf of an agency; or 
‘‘(ii) that portion of an information 
system used or operated by an agency or 
by a contractor of an agency or other orga-
nization on behalf of an agency.’’. 
SEC. 4. REPORT TO CONGRESS REGARDING OFFICE OF 
MANAGEMENT AND BUDGET ENFORCEMENT 
ACTION. 
Section 3553 of title 44, United States Code, as 
amended by section 3, is further amended by inserting the 
following at the end the following new subsection: 
‘‘(j) ANNUAL REPORT TO CONGRESS.— 
‘‘(1) REQUIREMENT.—Not later than February 
1 of every year, the Director shall report to the ap-
propriate congressional committee regarding the spe-
cific actions the Director has taken pursuant to sub-
section (a)(5), including any actions taken pursuant 
to paragraph (5) of title 40 section 11303(b). 
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS
‘‘(2) 
APPROPRIATE
CONGRESSIONAL
COM-
MITTEE.—In this subsection, the term ‘appropriate 
congressional committee’ means— 
‘‘(A) the Committee on Appropriations and 
the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate; and 
‘‘(B) the Committee on Appropriations and 
the Committee on Homeland Security Com-
mittee of the House of Representatives.’’. 
Æ 
VerDate Sep 11 2014 
18:19 Aug 07, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6301
E:\BILLS\H3402.IH
H3402
srobinson on DSK5SPTVN1PROD with BILLS