Sec. 1. Short title; table of contents. 
TITLE I—FACILITATING SHARING OF CYBER THREAT 
INFORMATION 
Sec. 101. Definitions. 
Sec. 102. Authorization to share cyber threat information. 
Sec. 103. Information sharing by the Federal Government. 
Sec. 104. Construction. 
Sec. 105. Report on implementation. 
Sec. 106. Inspector General review. 
Sec. 107. Technical amendments. 
Sec. 108. Access to classified information. 
TITLE II—COORDINATION OF FEDERAL INFORMATION SECURITY 
POLICY 
Sec. 201. Coordination of Federal information security policy. 
Sec. 202. Management of information technology. 
Sec. 203. No new funding. 
Sec. 204. Technical and conforming amendments. 
Sec. 205. Clarification of authorities. 
TITLE III—CRIMINAL PENALTIES 
Sec. 301. Penalties for fraud and related activity in connection with computers. 
Sec. 302. Trafficking in passwords. 
Sec. 303. Conspiracy and attempted computer fraud offenses. 
Sec. 304. Criminal and civil forfeiture for fraud and related activity in connec-
tion with computers. 
Sec. 305. Damage to critical infrastructure computers. 
Sec. 306. Limitation on actions involving unauthorized use. 
Sec. 307. No new funding. 
TITLE IV—CYBERSECURITY RESEARCH AND DEVELOPMENT 
Sec. 401. National High-Performance Computing Program planning and co-
ordination. 
Sec. 402. Research in areas of national importance. 
Sec. 403. Program improvements. 
Sec. 404. Improving education of networking and information technology, in-
cluding high performance computing. 
Sec. 405. Conforming and technical amendments to the High-Performance 
Computing Act of 1991. 
Sec. 406. Federal cyber scholarship-for-service program. 
Sec. 407. Study and analysis of certification and training of information infra-
structure professionals. 
Sec. 408. International cybersecurity technical standards. 
Sec. 409. Identity management research and development. 
Sec. 410. Federal cybersecurity research and development. 
TITLE V—DATA SECURITY AND BREACH NOTIFICATION 
Sec. 501. Requirements for information security. 
Sec. 502. Notification of information security breach. 
Sec. 503. Application and enforcement. 
Sec. 504. Definitions. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
Sec. 505. Effect on other laws. 
Sec. 506. Effective date. 
TITLE 
I—FACILITATING 
SHAR-
ING OF CYBER THREAT IN-
FORMATION 
SEC. 101. DEFINITIONS. 
In this title: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given the term in section 3502 of title 44, 
United States Code. 
(2) ANTITRUST
LAWS.—The term ‘‘antitrust 
laws’’— 
(A) has the meaning given the term in sec-
tion 1(a) of the Clayton Act (15 U.S.C. 12(a)); 
(B) includes section 5 of the Federal 
Trade Commission Act (15 U.S.C. 45) to the 
extent that section 5 of that Act applies to un-
fair methods of competition; and 
(C) includes any State law that has the 
same intent and effect as the laws under sub-
paragraphs (A) and (B). 
(3) COUNTERMEASURE.—The term ‘‘counter-
measure’’ means an automated or a manual action 
with defensive intent to mitigate cyber threats. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(4) CYBER THREAT INFORMATION.—The term 
‘‘cyber threat information’’ means information that 
indicates or describes— 
(A) a technical or operation vulnerability 
or a cyber threat mitigation measure; 
(B) an action or operation to mitigate a 
cyber threat; 
(C) malicious reconnaissance, including 
anomalous patterns of network activity that ap-
pear to be transmitted for the purpose of gath-
ering technical information related to a cyberse-
curity threat; 
(D) a method of defeating a technical con-
trol; 
(E) a method of defeating an operational 
control; 
(F) network activity or protocols known to 
be associated with a malicious cyber actor or 
that signify malicious cyber intent; 
(G) a method of causing a user with legiti-
mate access to an information system or infor-
mation that is stored on, processed by, or 
transiting an information system to inadvert-
ently enable the defeat of a technical or oper-
ational control; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(H) any other attribute of a cybersecurity 
threat or cyber defense information that would 
foster situational awareness of the United 
States cybersecurity posture, if disclosure of 
such attribute or information is not otherwise 
prohibited by law; 
(I) the actual or potential harm caused by 
a 
cyber 
incident, 
including 
information 
exfiltrated when it is necessary in order to iden-
tify or describe a cybersecurity threat; or 
(J) any combination of subparagraphs (A) 
through (I). 
(5) CYBERSECURITY CENTER.—The term ‘‘cy-
bersecurity center’’ means the Department of De-
fense Cyber Crime Center, the Intelligence Commu-
nity Incident Response Center, the United States 
Cyber Command Joint Operations Center, the Na-
tional Cyber Investigative Joint Task Force, the Na-
tional Security Agency/Central Security Service 
Threat Operations Center, the National Cybersecu-
rity and Communications Integration Center, and 
any successor center. 
(6) CYBERSECURITY SYSTEM.—The term ‘‘cy-
bersecurity system’’ means a system designed or em-
ployed to ensure the integrity, confidentiality, or 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
availability of, or to safeguard, a system or network, 
including measures intended to protect a system or 
network from— 
(A) efforts to degrade, disrupt, or destroy 
such system or network; or 
(B) theft or misappropriations of private 
or government information, intellectual prop-
erty, or personally identifiable information. 
(7) ENTITY.— 
(A) IN
GENERAL.—The term ‘‘entity’’ 
means any private entity, non-Federal Govern-
ment agency or department, or State, tribal, or 
local government agency or department (includ-
ing an officer, employee, or agent thereof). 
(B) INCLUSIONS.—The term ‘‘entity’’ in-
cludes a government agency or department (in-
cluding an officer, employee, or agent thereof) 
of the District of Columbia, the Commonwealth 
of Puerto Rico, the Virgin Islands, Guam, 
American Samoa, the Northern Mariana Is-
lands, and any other territory or possession of 
the United States. 
(8) FEDERAL
INFORMATION
SYSTEM.—The 
term ‘‘Federal information system’’ means an infor-
mation system of a Federal department or agency 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
used or operated by an executive agency, by a con-
tractor of an executive agency, or by another organi-
zation on behalf of an executive agency. 
(9) INFORMATION SECURITY.—The term ‘‘infor-
mation security’’ means protecting information and 
information systems from disruption or unauthorized 
access, use, disclosure, modification, or destruction 
in order to provide— 
(A) integrity, by guarding against im-
proper information modification or destruction, 
including by ensuring information nonrepudi-
ation and authenticity; 
(B) confidentiality, by preserving author-
ized restrictions on access and disclosure, in-
cluding means for protecting personal privacy 
and proprietary information; or 
(C) availability, by ensuring timely and re-
liable access to and use of information. 
(10) INFORMATION SYSTEM.—The term ‘‘infor-
mation system’’ has the meaning given the term in 
section 3502 of title 44, United States Code. 
(11) LOCAL
GOVERNMENT.—The term ‘‘local 
government’’ means any borough, city, county, par-
ish, town, township, village, or other general purpose 
political subdivision of a State. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(12) MALICIOUS RECONNAISSANCE.—The term 
‘‘malicious reconnaissance’’ means a method for ac-
tively probing or passively monitoring an information 
system for the purpose of discerning technical 
vulnerabilities of the information system, if such 
method is associated with a known or suspected cy-
bersecurity threat. 
(13) 
OPERATIONAL
CONTROL.—The 
term 
‘‘operational control’’ means a security control for 
an information system that primarily is implemented 
and executed by people. 
(14) 
OPERATIONAL
VULNERABILITY.—The 
term ‘‘operational vulnerability’’ means any attribute 
of policy, process, or procedure that could enable or 
facilitate the defeat of an operational control. 
(15) PRIVATE ENTITY.—The term ‘‘private en-
tity’’ means any individual or any private group, or-
ganization, or corporation, including an officer, em-
ployee, or agent thereof. 
(16) SIGNIFICANT CYBER INCIDENT.—The term 
‘‘significant cyber incident’’ means a cyber incident 
resulting in, or an attempted cyber incident that, if 
successful, would have resulted in— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(A) the exfiltration from a Federal infor-
mation system of data that is essential to the 
operation of the Federal information system; or 
(B) an incident in which an operational or 
technical control essential to the security or op-
eration of a Federal information system was de-
feated. 
(17) TECHNICAL CONTROL.—The term ‘‘tech-
nical control’’ means a hardware or software restric-
tion on, or audit of, access or use of an information 
system or information that is stored on, processed 
by, or transiting an information system that is in-
tended to ensure the confidentiality, integrity, or 
availability of that system. 
(18) TECHNICAL
VULNERABILITY.—The term 
‘‘technical vulnerability’’ means any attribute of 
hardware or software that could enable or facilitate 
the defeat of a technical control. 
(19) TRIBAL.—The term ‘‘tribal’’ has the 
meaning given the term ‘‘Indian tribe’’ in section 4 
of the Indian Self-Determination and Education As-
sistance Act (25 U.S.C. 450b). 
SEC. 102. AUTHORIZATION TO SHARE CYBER THREAT IN-
FORMATION. 
(a) VOLUNTARY DISCLOSURE.— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(1) PRIVATE ENTITIES.—Notwithstanding any 
other provision of law, a private entity may, for the 
purpose of preventing, investigating, or otherwise 
mitigating threats to information security, on its 
own networks, or as authorized by another entity, on 
such entity’s networks, employ countermeasures and 
use cybersecurity systems in order to obtain, iden-
tify, or otherwise possess cyber threat information. 
(2) ENTITIES.—Notwithstanding any other pro-
vision of law, an entity may disclose cyber threat in-
formation to— 
(A) a cybersecurity center; or 
(B) any other entity in order to assist with 
preventing, investigating, or otherwise miti-
gating threats to information security. 
(3) INFORMATION
SECURITY
PROVIDERS.—If 
the cyber threat information described in paragraph 
(1) is obtained, identified, or otherwise possessed in 
the course of providing information security prod-
ucts or services under contract to another entity, 
that entity shall be given, at any time prior to dis-
closure of such information, a reasonable oppor-
tunity to authorize or prevent such disclosure, to re-
quest anonymization of such information, or to re-
quest that reasonable efforts be made to safeguard 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
such information that identifies specific persons 
from unauthorized access or disclosure. 
(b) SIGNIFICANT
CYBER
INCIDENTS
INVOLVING 
FEDERAL INFORMATION SYSTEMS.— 
(1) IN
GENERAL.—An entity providing elec-
tronic communication services, remote computing 
services, or information security services to a Fed-
eral department or agency shall inform the Federal 
department or agency of a significant cyber incident 
involving the Federal information system of that 
Federal department or agency that— 
(A) is directly known to the entity as a re-
sult of providing such services; 
(B) is directly related to the provision of 
such services by the entity; and 
(C) as determined by the entity, has im-
peded or will impede the performance of a crit-
ical mission of the Federal department or agen-
cy. 
(2) ADVANCE COORDINATION.—A Federal de-
partment or agency receiving the services described 
in paragraph (1) shall coordinate in advance with an 
entity described in paragraph (1) to develop the pa-
rameters of any information that may be provided 
under paragraph (1), including clarification of the 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
type of significant cyber incident that will impede 
the performance of a critical mission of the Federal 
department or agency. 
(3) REPORT.—A Federal department or agency 
shall report information provided under this sub-
section to a cybersecurity center. 
(4) CONSTRUCTION.—Any information provided 
to a cybersecurity center under paragraph (3) shall 
be treated in the same manner as information pro-
vided to a cybersecurity center under subsection (a). 
(c) INFORMATION SHARED WITH OR PROVIDED TO 
A CYBERSECURITY CENTER.—Cyber threat information 
provided to a cybersecurity center under this section— 
(1) may be disclosed to, retained by, and used 
by, consistent with otherwise applicable Federal law, 
any Federal agency or department, component, offi-
cer, employee, or agent of the Federal Government 
for a cybersecurity purpose, a national security pur-
pose, or in order to prevent, investigate, or prosecute 
any of the offenses listed in section 2516 of title 18, 
United States Code, and such information shall not 
be disclosed to, retained by, or used by any Federal 
agency or department for any use not permitted 
under this paragraph; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(2) may, with the prior written consent of the 
entity submitting such information, be disclosed to 
and used by a State, tribal, or local government or 
government agency for the purpose of protecting in-
formation systems, or in furtherance of preventing, 
investigating, or prosecuting a criminal act, except 
that if the need for immediate disclosure prevents 
obtaining written consent, such consent may be pro-
vided orally with subsequent documentation of such 
consent; 
(3) shall be considered the commercial, finan-
cial, or proprietary information of the entity pro-
viding such information to the Federal Government 
and any disclosure outside the Federal Government 
may only be made upon the prior written consent by 
such entity and shall not constitute a waiver of any 
applicable privilege or protection provided by law, 
except that if the need for immediate disclosure pre-
vents obtaining written consent, such consent may 
be provided orally with subsequent documentation of 
such consent; 
(4) shall be deemed voluntarily shared informa-
tion and exempt from disclosure under section 552 
of title 5, United States Code, and any State, tribal, 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
or local law requiring disclosure of information or 
records; 
(5) shall be, without discretion, withheld from 
the public under section 552(b)(3)(B) of title 5, 
United States Code, and any State, tribal, or local 
law requiring disclosure of information or records; 
(6) shall not be subject to the rules of any Fed-
eral agency or department or any judicial doctrine 
regarding ex parte communications with a decision-
making official; 
(7) shall not, if subsequently provided to a 
State, tribal, or local government or government 
agency, otherwise be disclosed or distributed to any 
entity by such State, tribal, or local government or 
government agency without the prior written consent 
of the entity submitting such information, notwith-
standing any State, tribal, or local law requiring dis-
closure of information or records, except that if the 
need for immediate disclosure prevents obtaining 
written consent, such consent may be provided orally 
with subsequent documentation of such consent; and 
(8) shall not be directly used by any Federal, 
State, tribal, or local department or agency to regu-
late the lawful activities of an entity, including ac-
tivities relating to obtaining, identifying, or other-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
wise possessing cyber threat information, except that 
the procedures required to be developed and imple-
mented under this title shall not be considered regu-
lations within the meaning of this paragraph. 
(d) PROCEDURES RELATING TO INFORMATION SHAR-
ING WITH A CYBERSECURITY CENTER.—Not later than 
60 days after the date of enactment of this Act, the heads 
of each department or agency containing a cybersecurity 
center shall jointly develop, promulgate, and submit to 
Congress procedures to ensure that cyber threat informa-
tion shared with or provided to— 
(1) a cybersecurity center under this section— 
(A) may be submitted to a cybersecurity 
center by an entity, to the greatest extent pos-
sible, through a uniform, publicly available 
process or format that is easily accessible on 
the website of such cybersecurity center, and 
that includes the ability to provide relevant de-
tails about the cyber threat information and 
written consent to any subsequent disclosures 
authorized by this paragraph; 
(B) shall immediately be further shared 
with each cybersecurity center in order to pre-
vent, investigate, or otherwise mitigate threats 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
to information security across the Federal Gov-
ernment; 
(C) is handled by the Federal Government 
in a reasonable manner, including consideration 
of the need to protect the privacy and civil lib-
erties of individuals through anonymization or 
other appropriate methods, while fully accom-
plishing the objectives of this title, and the Fed-
eral Government may undertake efforts con-
sistent with this subparagraph to limit the im-
pact on privacy and civil liberties of the sharing 
of cyber threat information with the Federal 
Government; and 
(D) except as provided in this section, shall 
only be used, disclosed, or handled in accord-
ance with the provisions of subsection (c); and 
(2) a Federal agency or department under sub-
section (b) is provided immediately to a cybersecu-
rity center in order to prevent, investigate, or other-
wise mitigate threats to information security across 
the Federal Government. 
(e) INFORMATION SHARED BETWEEN ENTITIES.— 
(1) IN
GENERAL.—An entity sharing cyber 
threat information with another entity under this 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
title may restrict the use or sharing of such informa-
tion by such other entity. 
(2) FURTHER SHARING.—Cyber threat informa-
tion shared by any entity with another entity under 
this title— 
(A) shall only be further shared in accord-
ance with any restrictions placed on the sharing 
of such information by the entity authorizing 
such 
sharing, 
such 
as 
appropriate 
anonymization of such information; and 
(B) may not be used by any entity to gain 
an unfair competitive advantage to the det-
riment of the entity authorizing the sharing of 
such information, except that the conduct de-
scribed in paragraph (3) shall not constitute 
unfair competitive conduct. 
(3) INFORMATION SHARED WITH STATE, TRIB-
AL, 
OR
LOCAL
GOVERNMENT
OR
GOVERNMENT 
AGENCY.—Cyber threat information shared with a 
State, tribal, or local government or government 
agency under this title— 
(A) may, with the prior written consent of 
the entity sharing such information, be dis-
closed to and used by a State, tribal, or local 
government or government agency for the pur-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
pose of protecting information systems, or in 
furtherance of preventing, investigating, or 
prosecuting a criminal act, except if the need 
for immediate disclosure prevents obtaining 
written consent, consent may be provided orally 
with subsequent documentation of the consent; 
(B) shall be deemed voluntarily shared in-
formation and exempt from disclosure under 
any State, tribal, or local law requiring disclo-
sure of information or records; 
(C) shall not be disclosed or distributed to 
any entity by the State, tribal, or local govern-
ment or government agency without the prior 
written consent of the entity submitting such 
information, notwithstanding any State, tribal, 
or local law requiring disclosure of information 
or records, except if the need for immediate dis-
closure prevents obtaining written consent, con-
sent may be provided orally with subsequent 
documentation of the consent; and 
(D) shall not be directly used by any State, 
tribal, or local department or agency to regulate 
the lawful activities of an entity, including ac-
tivities relating to obtaining, identifying, or oth-
erwise possessing cyber threat information, ex-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
cept that the procedures required to be devel-
oped and implemented under this title shall not 
be considered regulations within the meaning of 
this subparagraph. 
(4) ANTITRUST EXEMPTION.—The exchange or 
provision of cyber threat information or assistance 
between 2 or more private entities under this title 
shall not be considered a violation of any provision 
of antitrust laws if exchanged or provided in order 
to assist with— 
(A) facilitating the prevention, investiga-
tion, or mitigation of threats to information se-
curity; or 
(B) communicating or disclosing of cyber 
threat information to help prevent, investigate 
or otherwise mitigate the effects of a threat to 
information security. 
(5) NO RIGHT OR BENEFIT.—The provision of 
cyber threat information to an entity under this sec-
tion shall not create a right or a benefit to similar 
information by such entity or any other entity. 
(f) FEDERAL PREEMPTION.— 
(1) IN GENERAL.—This section supersedes any 
statute or other law of a State or political subdivi-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
sion of a State that restricts or otherwise expressly 
regulates an activity authorized under this section. 
(2) STATE
LAW
ENFORCEMENT.—Nothing in 
this section shall be construed to supersede any stat-
ute or other law of a State or political subdivision 
of a State concerning the use of authorized law en-
forcement techniques. 
(3) 
PUBLIC
DISCLOSURE.—No 
information 
shared with or provided to a State, tribal, or local 
government or government agency pursuant to this 
section shall be made publicly available pursuant to 
any State, tribal, or local law requiring disclosure of 
information or records. 
(g) CIVIL AND CRIMINAL LIABILITY.— 
(1) GENERAL PROTECTIONS.— 
(A) PRIVATE ENTITIES.—No cause of ac-
tion shall lie or be maintained in any court 
against any private entity for— 
(i) the use of countermeasures and cy-
bersecurity systems as authorized by this 
title; 
(ii) the use, receipt, or disclosure of 
any cyber threat information as authorized 
by this title; or 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(iii) the subsequent actions or inac-
tions of any lawful recipient of cyber threat 
information provided by such private enti-
ty. 
(B) ENTITIES.—No cause of action shall 
lie or be maintained in any court against any 
entity for— 
(i) the use, receipt, or disclosure of 
any cyber threat information as authorized 
by this title; or 
(ii) the subsequent actions or inac-
tions of any lawful recipient of cyber threat 
information provided by such entity. 
(2) CONSTRUCTION.—Nothing in this sub-
section shall be construed as creating any immunity 
against, or otherwise affecting, any action brought 
by the Federal Government, or any agency or de-
partment thereof, to enforce any law, Executive 
order, or procedure governing the appropriate han-
dling, disclosure, and use of classified information. 
(h) OTHERWISE LAWFUL DISCLOSURES.—Nothing 
in this section shall be construed to limit or prohibit other-
wise lawful disclosures of communications, records, or 
other information by a private entity to any other govern-
mental or private entity not covered under this section. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(i) WHISTLEBLOWER PROTECTION.—Nothing in this 
Act shall be construed to preempt or preclude any em-
ployee from exercising rights currently provided under any 
whistleblower law, rule, or regulation. 
(j) RELATIONSHIP TO OTHER LAWS.—The submis-
sion of cyber threat information under this section to a 
cybersecurity center shall not affect any requirement 
under any other provision of law for an entity to provide 
information to the Federal Government. 
SEC. 103. INFORMATION SHARING BY THE FEDERAL GOV-
ERNMENT. 
(a) CLASSIFIED INFORMATION.— 
(1) PROCEDURES.—Consistent with the protec-
tion of intelligence sources and methods, and as oth-
erwise determined appropriate, the Director of Na-
tional Intelligence and the Secretary of Defense, in 
consultation with the heads of the appropriate Fed-
eral departments or agencies, shall develop and pro-
mulgate procedures to facilitate and promote— 
(A) the immediate sharing, through the cy-
bersecurity centers, of classified cyber threat in-
formation in the possession of the Federal Gov-
ernment with appropriately cleared representa-
tives of any appropriate entity; and 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(B) the declassification and immediate 
sharing, through the cybersecurity centers, with 
any entity or, if appropriate, public availability 
of cyber threat information in the possession of 
the Federal Government. 
(2) HANDLING OF CLASSIFIED INFORMATION.— 
The procedures developed under paragraph (1) shall 
ensure that each entity receiving classified cyber 
threat information pursuant to this section has ac-
knowledged in writing the ongoing obligation to com-
ply with all laws, Executive orders, and procedures 
concerning the appropriate handling, disclosure, or 
use of classified information. 
(b) UNCLASSIFIED CYBER THREAT INFORMATION.— 
The heads of each department or agency containing a cy-
bersecurity center shall jointly develop and promulgate 
procedures that ensure that, consistent with the provisions 
of this section, unclassified, including controlled unclassi-
fied, cyber threat information in the possession of the Fed-
eral Government— 
(1) is shared, through the cybersecurity centers, 
in an immediate and adequate manner with appro-
priate entities; and 
(2) if appropriate, is made publicly available. 
(c) DEVELOPMENT OF PROCEDURES.— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(1) IN
GENERAL.—The procedures developed 
under this section shall incorporate, to the greatest 
extent possible, existing processes utilized by sector 
specific information sharing and analysis centers. 
(2) COORDINATION WITH ENTITIES.—In devel-
oping the procedures required under this section, the 
Director of National Intelligence and the heads of 
each department or agency containing a cybersecu-
rity center shall coordinate with appropriate entities 
to ensure that protocols are implemented that will 
facilitate and promote the sharing of cyber threat in-
formation by the Federal Government. 
(d) ADDITIONAL RESPONSIBILITIES OF CYBERSECU-
RITY CENTERS.—Consistent with section 102, a cyberse-
curity center shall— 
(1) facilitate information sharing, interaction, 
and collaboration among and between cybersecurity 
centers and— 
(A) other Federal entities; 
(B) any entity; and 
(C) international partners, in consultation 
with the Secretary of State; 
(2) disseminate timely and actionable cyberse-
curity threat, vulnerability, mitigation, and warning 
information, including alerts, advisories, indicators, 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
signatures, and mitigation and response measures, 
to improve the security and protection of informa-
tion systems; and 
(3) coordinate with other Federal entities, as 
appropriate, to integrate information from across 
the Federal Government to provide situational 
awareness of the cybersecurity posture of the United 
States. 
(e) SHARING
WITHIN
THE
FEDERAL
GOVERN-
MENT.—The heads of appropriate Federal departments 
and agencies shall ensure that cyber threat information 
in the possession of such Federal departments or agencies 
that relates to the prevention, investigation, or mitigation 
of threats to information security across the Federal Gov-
ernment is shared effectively with the cybersecurity cen-
ters. 
(f) SUBMISSION TO CONGRESS.—Not later than 60 
days after the date of enactment of this Act, the Director 
of National Intelligence, in coordination with the appro-
priate head of a department or an agency containing a 
cybersecurity center, shall submit the procedures required 
by this section to Congress. 
SEC. 104. CONSTRUCTION. 
(a) INFORMATION SHARING RELATIONSHIPS.—Noth-
ing in this title shall be construed— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(1) to limit or modify an existing information 
sharing relationship; 
(2) to prohibit a new information sharing rela-
tionship; 
(3) to require a new information sharing rela-
tionship between any entity and the Federal Govern-
ment, except as specified under section 102(b); or 
(4) to modify the authority of a department or 
agency of the Federal Government to protect sources 
and methods and the national security of the United 
States. 
(b) ANTI-TASKING RESTRICTION.—Nothing in this 
title shall be construed to permit the Federal Govern-
ment— 
(1) to require an entity to share information 
with the Federal Government, except as expressly 
provided under section 102(b); or 
(2) to condition the sharing of cyber threat in-
formation with an entity on such entity’s provision 
of cyber threat information to the Federal Govern-
ment. 
(c) NO LIABILITY FOR NON-PARTICIPATION.—Noth-
ing in this title shall be construed to subject any entity 
to liability for choosing not to engage in the voluntary ac-
tivities authorized under this title. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(d) USE AND RETENTION OF INFORMATION.—Noth-
ing in this title shall be construed to authorize, or to mod-
ify any existing authority of, a department or agency of 
the Federal Government to retain or use any information 
shared under section 102 for any use other than a use 
permitted under subsection 102(c)(1). 
(e) NO NEW FUNDING.—An applicable Federal agen-
cy shall carry out the provisions of this title with existing 
facilities and funds otherwise available, through such 
means as the head of the agency considers appropriate. 
SEC. 105. REPORT ON IMPLEMENTATION. 
(a) CONTENT OF REPORT.—Not later than 1 year 
after the date of enactment of this Act, and biennially 
thereafter, the heads of each department or agency con-
taining a cybersecurity center shall jointly submit, in co-
ordination with the privacy and civil liberties officials of 
such departments or agencies and the Privacy and Civil 
Liberties Oversight Board, a detailed report to Congress 
concerning the implementation of this title, including— 
(1) an assessment of the sufficiency of the pro-
cedures developed under section 103 of this Act in 
ensuring that cyber threat information in the posses-
sion of the Federal Government is provided in an 
immediate and adequate manner to appropriate enti-
ties or, if appropriate, is made publicly available; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(2) an assessment of whether information has 
been appropriately classified and an accounting of 
the number of security clearances authorized by the 
Federal Government for purposes of this title; 
(3) a review of the type of cyber threat infor-
mation shared with a cybersecurity center under sec-
tion 102 of this Act, including whether such infor-
mation meets the definition of cyber threat informa-
tion under section 101, the degree to which such in-
formation may impact the privacy and civil liberties 
of individuals, any appropriate metrics to determine 
any impact of the sharing of such information with 
the Federal Government on privacy and civil lib-
erties, and the adequacy of any steps taken to re-
duce such impact; 
(4) a review of actions taken by the Federal 
Government based on information provided to a cy-
bersecurity center under section 102 of this Act, in-
cluding the appropriateness of any subsequent use 
under section 102(c)(1) of this Act and whether 
there was inappropriate stovepiping within the Fed-
eral Government of any such information; 
(5) a description of any violations of the re-
quirements of this title by the Federal Government; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(6) a classified list of entities that received clas-
sified information from the Federal Government 
under section 103 of this Act and a description of 
any indication that such information may not have 
been appropriately handled; 
(7) a summary of any breach of information se-
curity, if known, attributable to a specific failure by 
any entity or the Federal Government to act on 
cyber threat information in the possession of such 
entity or the Federal Government that resulted in 
substantial economic harm or injury to a specific en-
tity or the Federal Government; and 
(8) any recommendation for improvements or 
modifications to the authorities under this title. 
(b) FORM OF REPORT.—The report under subsection 
(a) shall be submitted in unclassified form, but shall in-
clude a classified annex. 
SEC. 106. INSPECTOR GENERAL REVIEW. 
(a) IN GENERAL.—The Council of the Inspectors 
General on Integrity and Efficiency are authorized to re-
view compliance by the cybersecurity centers, and by any 
Federal department or agency receiving cyber threat infor-
mation from such cybersecurity centers, with the proce-
dures required under section 102 of this Act. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(b) SCOPE
OF REVIEW.—The review under sub-
section (a) shall consider whether the Federal Government 
has handled such cyber threat information in a reasonable 
manner, including consideration of the need to protect the 
privacy and civil liberties of individuals through 
anonymization or other appropriate methods, while fully 
accomplishing the objectives of this title. 
(c) REPORT TO CONGRESS.—Each review conducted 
under this section shall be provided to Congress not later 
than 30 days after the date of completion of the review. 
SEC. 107. TECHNICAL AMENDMENTS. 
Section 552(b) of title 5, United States Code, is 
amended— 
(1) in paragraph (8), by striking ‘‘or’’; 
(2) in paragraph (9), by striking ‘‘wells.’’ and 
inserting ‘‘wells; or’’; and 
(3) by adding at the end the following: 
‘‘(10) information shared with or provided to a 
cybersecurity center under section 102 of title I of 
the Strengthening and Enhancing Cybersecurity by 
Using Research, Education, Information, and Tech-
nology Act of 2013.’’. 
SEC. 108. ACCESS TO CLASSIFIED INFORMATION. 
(a) AUTHORIZATION REQUIRED.—No person shall be 
provided with access to classified information (as defined 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
in section 6.1 of Executive Order 13526 (50 U.S.C. 435 
note; relating to classified national security information)) 
relating to cyber security threats or cyber security 
vulnerabilities under this title without the appropriate se-
curity clearances. 
(b) SECURITY CLEARANCES.—The appropriate Fed-
eral agencies or departments shall, consistent with appli-
cable procedures and requirements, and if otherwise 
deemed appropriate, assist an individual in timely obtain-
ing an appropriate security clearance where such indi-
vidual has been determined to be eligible for such clear-
ance and has a need-to-know (as defined in section 6.1 
of that Executive order) classified information to carry out 
this title. 
TITLE 
II—COORDINATION 
OF 
FEDERAL INFORMATION SE-
CURITY POLICY 
SEC. 201. COORDINATION OF FEDERAL INFORMATION SE-
CURITY POLICY. 
(a) IN GENERAL.—Chapter 35 of title 44, United 
States Code, is amended by striking subchapters II and 
III and inserting the following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS