SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Reporting Attacks 
from Nations Selected for Oversight and Monitoring Web 
Attacks and Ransomware from Enemies Act’’ or the 
‘‘RANSOMWARE Act’’. 
SEC. 2. RANSOMWARE AND OTHER CYBER-RELATED AT-
TACKS. 
Section 14 of the U.S. SAFE WEB Act of 2006 
(Public Law 109–455; 120 Stat. 3382) is amended— 
(1) in the matter preceding paragraph (1)— 
(A) by striking ‘‘Not later than 3 years 
after the date of enactment of this Act,’’ and 
inserting ‘‘Not later than 1 year after the date 
of enactment of the Reporting Attacks from 
Nations Selected for Oversight and Monitoring 
Web Attacks and Ransomware from Enemies 
Act, and every 2 years thereafter,’’; and 
(B) by inserting ‘‘, with respect to the 2- 
year period preceding the date of the report (or, 
in the case of the first report transmitted under 
this section after the date of the enactment of 
the Reporting Attacks from Nations Selected 
for Oversight and Monitoring Web Attacks and 
Ransomware from Enemies Act, the 1-year pe-
riod preceding the date of the report)’’ after 
‘‘include’’;
(2) in paragraph (8), by striking ‘‘; and’’ and 
inserting a semicolon; 
(3) in paragraph (9), by striking the period at 
the end and inserting ‘‘; and’’; and 
(4) by adding at the end the following: 
‘‘(10) the number and details of cross-border 
complaints received by the Commission that involve 
ransomware or other cyber-related attacks— 
‘‘(A) that were committed by individuals 
located in foreign countries or with ties to for-
eign countries; and 
‘‘(B) that were committed by companies lo-
cated in foreign countries or with ties to foreign 
countries.’’. 
SEC. 3. REPORT ON RANSOMWARE AND OTHER CYBER-RE-
LATED ATTACKS BY CERTAIN FOREIGN INDI-
VIDUALS, COMPANIES, AND GOVERNMENTS. 
(a) IN GENERAL.—Not later than 1 year after the 
date of the enactment of this Act, and every 2 years there-
after, the Federal Trade Commission shall transmit to the 
Committee on Energy and Commerce of the House of 
Representatives and the Committee on Commerce, 
Science, and Transportation of the Senate a report de-
scribing its use of and experience with the authority grant-
ed by the U.S. SAFE WEB Act of 2006 (Public Law 109–
455) and the amendments made by such Act. The report 
shall include the following: 
(1) The number and details of cross-border 
complaints received by the Commission (including 
which such complaints were acted upon and which 
such complaints were not acted upon) that relate to 
incidents that were committed by individuals, com-
panies, or governments described in subsection (b), 
broken down by each type of individual, type of com-
pany, or government described in a paragraph of 
such subsection. 
(2) The number and details of cross-border 
complaints received by the Commission (including 
which such complaints were acted upon and which 
such complaints were not acted upon) that involve 
ransomware or other cyber-related attacks that were 
committed by individuals, companies, or govern-
ments described in subsection (b), broken down by 
each type of individual, type of company, or govern-
ment described in a paragraph of such subsection. 
(3) A description of trends in the number of 
cross-border complaints received by the Commission 
that relate to incidents that were committed by indi-
viduals, companies, or governments described in sub-
section (b), broken down by each type of individual,
type of company, or government described in a para-
graph of such subsection. 
(4) Identification and details of foreign agencies 
(including foreign law enforcement agencies (as de-
fined in section 4 of the Federal Trade Commission 
Act (15 U.S.C. 44))) located in Russia, China, 
North Korea, or Iran with which the Commission 
has cooperated and the results of such cooperation, 
including any foreign agency enforcement action or 
lack thereof. 
(5) A description of Commission litigation, in 
relation to cross-border complaints described in 
paragraphs (1) and (2), brought in foreign courts 
and the results of such litigation. 
(6) Any recommendations for legislation that 
may advance the mission of the Commission in car-
rying out the U.S. SAFE WEB Act of 2006 and the 
amendments made by such Act. 
(7) Any recommendations for legislation that 
may advance the security of the United States and 
United States companies against ransomware and 
other cyber-related attacks. 
(8) Any recommendations for United States 
citizens and United States businesses to implement
best practices on mitigating ransomware and other 
cyber-related attacks. 
(b) INDIVIDUALS, COMPANIES, AND GOVERNMENTS 
DESCRIBED.—The individuals, companies, and govern-
ments described in this subsection are the following: 
(1) An individual located within Russia or with 
direct or indirect ties to the Government of the Rus-
sian Federation. 
(2) A company located within Russia or with di-
rect or indirect ties to the Government of the Rus-
sian Federation. 
(3) The Government of the Russian Federation. 
(4) An individual located within China or with 
direct or indirect ties to the Government of the Peo-
ple’s Republic of China. 
(5) A company located within China or with di-
rect or indirect ties to the Government of the Peo-
ple’s Republic of China. 
(6) The Government of the People’s Republic of 
China. 
(7) An individual located within North Korea or 
with direct or indirect ties to the Government of the 
Democratic People’s Republic of Korea.