I 
115TH CONGRESS 
1ST SESSION H. R. 4036 
To amend title 18, United States Code, to provide a defense to prosecution 
for fraud and related activity in connection with computers for persons 
defending against unauthorized intrusions into their computers, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 12, 2017 
Mr. GRAVES of Georgia (for himself and Ms. SINEMA) introduced the following 
bill; which was referred to the Committee on the Judiciary 
A BILL 
To amend title 18, United States Code, to provide a defense 
to prosecution for fraud and related activity in connec-
tion with computers for persons defending against unau-
thorized intrusions into their computers, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Active Cyber Defense 
Certainty Act’’. 
SEC. 2. CONGRESSIONAL FINDINGS. 
Congress finds the following: 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
(1) Cyber fraud and related cyber-enabled 
crimes pose a severe threat to the national security 
and economic vitality of the United States. 
(2) As a result of the unique nature of 
cybercrime, it is very difficult for law enforcement to 
respond to and prosecute cybercrime in a timely 
manner, leading to the existing low level of deter-
rence and a rapidly growing threat. In 2015, the De-
partment of Justice prosecuted only 153 cases of 
computer fraud. Congress determines that this sta-
tus quo is unacceptable and that if left unchecked, 
the trend in cybercrime will only continue to deterio-
rate. 
(3) Cybercriminals have developed new tactics 
for monetizing the proceeds of their criminal acts, 
making it likely that the criminal activity will be fur-
ther incentivized in the absence of reforms to cur-
rent law allowing for new cyber tools and deterrence 
methods for defenders. 
(4) When a citizen or United States business is 
victimized as the result of such crime, the first re-
course should be to report the crime to law enforce-
ment and seek to improve defensive measures. 
(5) Congress also acknowledges that many 
cyberattacks could be prevented through improved 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
cyber defensive practices, including enhanced train-
ing, strong passwords, and routine updating and 
patching to computer systems. 
(6) Congress determines that the use of active 
cyber defense techniques, when properly applied, can 
also assist in improving defenses and deterring 
cybercrimes. 
(7) Congress also acknowledges that many pri-
vate entities are increasingly concerned with stem-
ming the growth of dark web based cyber-enabled 
crimes. The Department of Justice should attempt 
to clarify the proper protocol for entities who are en-
gaged in active cyber defense in the dark web so 
that these defenders can return private property 
such as intellectual property and financial records 
gathered inadvertently. 
(8) Congress also recognizes that while Federal 
agencies will need to prioritize cyber incidents of na-
tional significance, there is the potential to assist the 
private sector by being more responsive to reports of 
crime through different reporting mechanisms. Many 
reported cybercrimes are not responded to in a time-
ly manner creating significant uncertainty for many 
businesses and individuals. 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
(9) Computer defenders should also exercise ex-
treme caution to avoid violating the law of any other 
nation where an attacker’s computer may reside. 
(10) Congress holds that active cyber defense 
techniques should only be used by qualified defend-
ers with a high degree of confidence in attribution, 
and that extreme caution should be taken to avoid 
impacting intermediary computers or resulting in an 
escalatory cycle of cyber activity. 
(11) It is the purpose of this Act to provide 
legal certainty by clarifying the type of tools and 
techniques that defenders can use that exceed the 
boundaries of their own computer network. 
SEC. 3. EXCEPTION FOR THE USE OF ATTRIBUTIONAL 
TECHNOLOGY. 
Section 1030 of title 18, United States Code, is 
amended by adding at the end the following: 
‘‘(k) EXCEPTION FOR THE USE OF ATTRIBUTIONAL 
TECHNOLOGY.— 
‘‘(1) This section shall not apply with respect to 
the use of attributional technology in regard to a de-
fender who uses a program, code, or command for 
attributional purposes that beacons or returns loca-
tional or attributional data in response to a cyber in-
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
trusion in order to identify the source of an intru-
sion; if— 
‘‘(A) the program, code, or command origi-
nated on the computer of the defender but is 
copied or removed by an unauthorized user; and 
‘‘(B) the program, code or command does 
not result in the destruction of data or result 
in an impairment of the essential operating 
functionality of the attacker’s computer system, 
or intentionally create a backdoor enabling in-
trusive access into the attacker’s computer sys-
tem. 
‘‘(2) DEFINITION.—The term ‘attributional 
data’ means any digital information such as log files, 
text strings, time stamps, malware samples, identi-
fiers such as user names and Internet Protocol ad-
dresses and metadata or other digital artifacts gath-
ered through forensic analysis.’’. 
SEC. 4. EXCLUSION FROM PROSECUTION FOR CERTAIN 
COMPUTER CRIMES FOR THOSE TAKING AC-
TIVE CYBER DEFENSE MEASURES. 
Section 1030 of title 18, United States Code, is 
amended by adding at the end the following: 
‘‘(l) ACTIVE CYBER DEFENSE MEASURES NOT A 
VIOLATION.— 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
‘‘(1) GENERALLY.—It is a defense to a criminal 
prosecution under this section that the conduct con-
stituting the offense was an active cyber defense 
measure. 
‘‘(2) INAPPLICABILITY TO CIVIL ACTION.—the 
defense against prosecution created by this section 
does not prevent a United States person or entity 
who is targeted by an active defense measure from 
seeking a civil remedy, including compensatory dam-
ages or injunctive relief pursuant to subsection (g). 
‘‘(3) DEFINITIONS.—In this subsection— 
‘‘(A) the term ‘defender’ means a person 
or an entity that is a victim of a persistent un-
authorized intrusion of the individual entity’s 
computer; 
‘‘(B) the term ‘active cyber defense meas-
ure’— 
‘‘(i) means any measure— 
‘‘(I) undertaken by, or at the di-
rection of, a defender; and 
‘‘(II) 
consisting 
of 
accessing 
without authorization the computer of 
the attacker to the defender’s own 
network to gather information in 
order to— 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
‘‘(aa) establish attribution of 
criminal activity to share with 
law 
enforcement 
and 
other 
United States Government agen-
cies responsible for cybersecurity; 
‘‘(bb) disrupt continued un-
authorized activity against the 
defender’s own network; or 
‘‘(cc) monitor the behavior 
of an attacker to assist in devel-
oping future intrusion prevention 
or cyber defense techniques; but 
‘‘(ii) does not include conduct that— 
‘‘(I) intentionally destroys or ren-
ders inoperable information that does 
not belong to the victim that is stored 
on another person or entity’s com-
puter; 
‘‘(II) recklessly causes physical 
injury or financial loss as described 
under subsection (c)(4); 
‘‘(III) creates a threat to the 
public health or safety; 
‘‘(IV) intentionally exceeds the 
level of activity required to perform 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
reconnaissance on an intermediary 
computer to allow for attribution of 
the origin of the persistent cyber in-
trusion; 
‘‘(V) intentionally results in in-
trusive or remote access into an 
intermediary’s computer; 
‘‘(VI) intentionally results in the 
persistent disruption to a person or 
entities internet connectivity resulting 
in damages defined under subsection 
(c)(4); or 
‘‘(VII) impacts any computer de-
scribed under subsection (a)(1) re-
garding access to national security in-
formation, subsection (a)(3) regarding 
government computers, or to sub-
section (c)(4)(A)(i)(V) regarding a 
computer system used by or for a 
Government entity for the furtherance 
of the administration of justice, na-
tional defense, or national security; 
‘‘(C) the term ‘attacker’ means a person or 
an entity that is the source of the persistent un-
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
authorized intrusion into the victim’s computer; 
and 
‘‘(D) the term ‘intermediary computer’ 
means a person or entity’s computer that is not 
under the ownership or primary control of the 
attacker but has been used to launch or obscure 
the origin of the persistent cyber-attack.’’. 
SEC. 5. NOTIFICATION REQUIREMENT FOR THE USE OF AC-
TIVE CYBER DEFENSE MEASURES. 
Section 1030 of title 18, United States Code, is 
amended by adding the following: 
‘‘(m) NOTIFICATION REQUIREMENT FOR THE USE 
OF ACTIVE CYBER DEFENSE MEASURES.— 
‘‘(1) GENERALLY.—A defender who uses an ac-
tive cyber defense measure under the preceding sec-
tion must notify the FBI National Cyber Investiga-
tive Joint Task Force and receive a response from 
the FBI acknowledging receipt of the notification 
prior to using the measure. 
‘‘(2) REQUIRED
INFORMATION.—Notification 
must include the type of cyber breach that the per-
son or entity was a victim of, the intended target of 
the active cyber defense measure, the steps the de-
fender plans to take to preserve evidence of the 
attacker’s criminal cyber intrusion, as well as the 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
steps they plan to prevent damage to intermediary 
computers not under the ownership of the attacker 
and other information requested by the FBI to as-
sist with oversight.’’. 
SEC. 6. VOLUNTARY PREEMPTIVE REVIEW OF ACTIVE 
CYBER DEFENSE MEASURES. 
(a) PILOT PROGRAM.—The Federal Bureau of Inves-
tigation (hereinafter in this section referred to as the 
‘‘FBI’’), in coordination with other Federal agencies, shall 
create a pilot program to last for 2 years after the date 
of enactment of this Act, to allow for a voluntary preemp-
tive review of active defense measures. 
(b) ADVANCE REVIEW.—A defender who intends to 
prepare an active defense measure under section 4 may 
submit their notification to the FBI National Cyber Inves-
tigative Joint Task Force in advance of its use so that 
the FBI and other agencies can review the notification and 
provide its assessment on how the proposed active defense 
measure may be amended to better conform to Federal 
law, the terms of section 4, and improve the technical op-
eration of the measure. 
(c) PRIORITIZATION OF REQUESTS.—The FBI may 
decide how to prioritize the issuance of such guidance to 
defenders based on the availability of resources. 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
SEC. 7. ANNUAL REPORT ON THE FEDERAL GOVERNMENT’S 
PROGRESS IN DETERRING CYBER FRAUD 
AND CYBER-ENABLED CRIMES. 
The Department of Justice, after consultation with 
the Department of Homeland Security and other relevant 
Federal agencies, shall deliver an annual report to Con-
gress not later than March 31 of each year, detailing the 
results of law enforcement activities pertaining to 
cybercriminal deterrence for the previous calendar year. 
The report shall include— 
(1) the number of computer fraud cases re-
ported by United States citizens and United States 
businesses to FBI Field Offices, the Secret Service 
Electronic Crimes Task Force, the Internet Crimes 
Complaint Center (IC3) website, and other Federal 
law enforcement agencies; 
(2) the number of investigations opened as a re-
sult of public reporting of computer fraud crimes, 
and the number of investigations open independently 
of any specific crimes being reported; 
(3) the number of cyber fraud cases prosecuted 
under section 1030 of title 18, United States Code, 
and other related statutes involving cybercrime, in-
cluding the resolution of the cases; 
(4) the number of computer fraud crimes deter-
mined to have originated from United States sus-
VerDate Sep 11 2014 
20:42 Oct 16, 2017
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
pects and the number determined to have originated 
from foreign suspects, and details of the country of 
origin of the suspected foreign suspects; 
(5) the number of dark web cybercriminal mar-
ketplaces and cybercriminal networks disabled by 
law enforcement activities; 
(6) an estimate of the total financial damages 
suffered by United States citizens and businesses re-
sulting from ransomware and other fraudulent 
cyberattacks; 
(7) the number of law enforcement personnel 
assigned to investigate and prosecute cybercrimes; 
and 
(8) the number of active cyber defense notifica-
tions filed as required by this Act and a comprehen-
sive evaluation of the notification process and vol-
untary preemptive review pilot program. 
SEC. 8. REQUIREMENT FOR THE DEPARTMENT OF JUSTICE 
TO UPDATE THE MANUAL ON THE PROSECU-
TION OF CYBER CRIMES. 
(a) The Department of Justice shall update the 
‘‘Prosecuting Computer Crimes Manual’’ to reflect the 
changes made by this legislation. 
(b) The Department of Justice is encouraged to seek 
additional opportunities to clarify the manual and other 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS
guidance to the public to reflect evolving defensive tech-
niques and cyber technology that can be used in manner 
that does not violate section 1030 of title 18, United 
States Code, or other Federal law and international trea-
ties. 
SEC. 9. SUNSET. 
The exclusion from prosecution created by this Act 
shall expire 2 years after the date of enactment of this 
Act. 
Æ 
VerDate Sep 11 2014 
23:15 Oct 13, 2017
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6301
E:\BILLS\H4036.IH
H4036
ethrower on DSK3G9T082PROD with BILLS