I 
114TH CONGRESS 
1ST SESSION H. R. 3305 
To help enhance American network security and mitigate cybersecurity risks, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 29, 2015 
Mr. HURD of Texas (for himself, Mr. MCCAUL, and Mr. RATCLIFFE) intro-
duced the following bill; which was referred to the Committee on Over-
sight and Government Reform, and in addition to the Committee on 
Homeland Security, for a period to be subsequently determined by the 
Speaker, in each case for consideration of such provisions as fall within 
the jurisdiction of the committee concerned 
A BILL 
To help enhance American network security and mitigate 
cybersecurity risks, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘EINSTEIN Act of 
2015’’. 
VerDate Sep 11 2014 
01:57 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3305.IH
H3305
rfrederick on DSK6VPTVN1PROD with BILLS
SEC. 2. PROTECTION OF FEDERAL CIVILIAN INFORMATION 
SYSTEMS. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend-
ed by adding at the end the following new section: 
‘‘SEC. 230. AVAILABLE PROTECTION OF FEDERAL CIVILIAN 
INFORMATION SYSTEMS. 
‘‘(a) IN GENERAL.—The Secretary shall deploy, oper-
ate, and maintain, to make available for use by any Fed-
eral agency, with or without reimbursement, capabilities 
to protect Federal agency information and Federal civilian 
information systems, including technologies to diagnose, 
detect, prevent, and mitigate against cybersecurity risks 
involving Federal agency information or Federal civilian 
information systems. 
‘‘(b) ACTIVITIES.—In carrying out this section, the 
Secretary may— 
‘‘(1) access, and Federal agency heads may dis-
close to the Secretary or a private entity providing 
assistance to the Secretary under paragraph (2), in-
formation traveling to or from or stored on a Fed-
eral civilian information system, regardless of from 
where the Secretary or a private entity providing as-
sistance to the Secretary under paragraph (2) ac-
cesses such information, notwithstanding any other 
provision of law that would otherwise restrict or pre-
VerDate Sep 11 2014 
01:57 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3305.IH
H3305
rfrederick on DSK6VPTVN1PROD with BILLS
vent Federal agency heads from disclosing such in-
formation to the Secretary or a private entity pro-
viding assistance to the Secretary under paragraph 
(2); 
‘‘(2) enter into contracts or other agreements, 
or otherwise request and obtain the assistance of, 
private entities to deploy, operate, and maintain 
technologies in accordance with subsection (a); and 
‘‘(3) retain, use, and disclose information ob-
tained through the conduct of activities authorized 
under this section only to protect Federal agency in-
formation and Federal civilian information systems 
from cybersecurity risks or in furtherance of the na-
tional cybersecurity and communications integration 
center’s authority under the second section 226, or, 
with the approval of the Attorney General and if dis-
closure of such information is not otherwise prohib-
ited by law, to law enforcement only to investigate, 
prosecute, disrupt, or otherwise respond to— 
‘‘(A) a violation of section 1030 of title 18, 
United States Code; 
‘‘(B) an imminent threat of death or seri-
ous bodily harm; 
VerDate Sep 11 2014 
01:57 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3305.IH
H3305
rfrederick on DSK6VPTVN1PROD with BILLS
‘‘(C) a serious threat to a minor, including 
sexual exploitation or threats to physical safety; 
or 
‘‘(D) an attempt, or conspiracy, to commit 
an offense described in any of subparagraphs 
(A) through (C). 
‘‘(c) CONDITIONS.—Contracts or other agreements 
under subsection (b)(2) shall include appropriate provi-
sions barring— 
‘‘(1) the disclosure of information to any entity 
other than the Department or a Federal agency dis-
closing information in accordance with subsection 
(b)(1) that can be used to identify specific persons 
and is reasonably believed to be unrelated to a cy-
bersecurity risk; and 
‘‘(2) the use of any information to which such 
private entity gains access in accordance with this 
section for any purpose other than to protect Fed-
eral agency information and Federal civilian infor-
mation systems against cybersecurity risks or to ad-
minister any such contract or other agreement. 
‘‘(d) LIMITATION.—No cause of action shall lie in any 
court against a private entity for assistance provided to 
the Secretary in accordance with this section and a con-
tract or agreement under subsection (b)(2). 
VerDate Sep 11 2014 
01:57 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3305.IH
H3305
rfrederick on DSK6VPTVN1PROD with BILLS
‘‘(e) DEFINITION.—The term ‘cybersecurity risk’ has 
the meaning given such term in the second section 226 
(relating to the national cybersecurity and communica-
tions integration center).’’. 
(b) DEFINITIONS.—Paragraphs (1) and (2) of the 
second section 226 of the Homeland Security Act of 2002 
(6 U.S.C. 148; relating to the national cybersecurity and 
communications integration center) are amended to read 
as follows: 
‘‘(1)(A) except as provided in subparagraph 
(B), the term ‘cybersecurity risk’ means threats to 
and vulnerabilities of information or information sys-
tems and any related consequences caused by or re-
sulting from unauthorized access, use, disclosure, 
degradation, disruption, modification, or destruction 
of such information or information systems, includ-
ing such related consequences caused by an act of 
terrorism; and 
‘‘(B) such term does not include any action that 
solely involves a violation of a consumer term of 
service or a consumer licensing agreement; 
‘‘(2) the term ‘incident’ means an occurrence 
that actually or imminently jeopardizes, without law-
ful authority, the integrity, confidentiality, or avail-
ability of information on an information system, or 
VerDate Sep 11 2014 
03:37 Aug 05, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3305.IH
H3305
rfrederick on DSK6VPTVN1PROD with BILLS
actually or imminently jeopardizes, without lawful 
authority, an information system;’’. 
(c) CLERICAL AMENDMENT.—The table of contents 
of the Homeland Security Act of 2002 is amended by add-
ing at the end the following new item: 
‘‘Sec. 230. Available protection of Federal civilian information systems.’’. 
Æ 
VerDate Sep 11 2014 
03:37 Aug 05, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6301
E:\BILLS\H3305.IH
H3305
rfrederick on DSK6VPTVN1PROD with BILLS