I 
117TH CONGRESS 
1ST SESSION H. R. 5501 
To require certain entities to disclose to the Secretary of Homeland Security 
ransom payments, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 5, 2021 
Ms. ROSS introduced the following bill; which was referred to the Committee 
on Energy and Commerce 
A BILL 
To require certain entities to disclose to the Secretary of 
Homeland Security ransom payments, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Ransom Disclosure 
Act’’. 
SEC. 2. DISCLOSURE OF RANSOM PAYMENTS. 
(a) DEFINITIONS.—In this section: 
(1) COVERED ENTITY.—The term ‘‘covered en-
tity’’— 
(A) means a public or private entity that— 
VerDate Sep 11 2014 
02:11 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5501.IH
H5501
pbinns on DSKJLVW7X2PROD with BILLS
(i) is engaged in interstate commerce 
or an activity affecting interstate com-
merce; or 
(ii) receives Federal funds; 
(B) includes a local government; and 
(C) does not include an individual. 
(2) INFORMATION SYSTEM.—The term ‘‘infor-
mation system’’ has the meaning given such term in 
section 3502 of title 44, United States Code. 
(3) RANSOM.—The term ‘‘ransom’’ means 
money or other thing of value demanded by an actor 
from a covered entity or individual after such actor 
gains control of an information system of such entity 
or individual. 
(4) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Homeland Security. 
(b) DISCLOSURE REQUIRED.—Not later than 48 
hours after a covered entity pays a ransom, the covered 
entity shall disclose to the Secretary, in accordance with 
subsection (b), such payment. 
(c) CONTENTS.—A disclosure made under subsection 
(b) shall include, with respect to the ransom at issue, the 
following: 
(1) The date on which such ransom was de-
manded. 
VerDate Sep 11 2014 
02:11 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5501.IH
H5501
pbinns on DSKJLVW7X2PROD with BILLS
(2) The date on which such ransom was paid. 
(3) The amount of such ransom demanded. 
(4) The amount of such ransom paid. 
(5) An identification of the currency, including 
if cryptocurrency, used for payment of such ransom. 
(6) Whether the covered entity that paid such 
ransom receives Federal funds. 
(7) Any known information regarding the iden-
tity of the actor demanding such ransom. 
(d) NONCOMPLIANCE.—The Secretary shall establish 
by regulation appropriate penalties for a covered entity 
that fails to make a disclosure required under subsection 
(b). 
(e) PUBLIC AVAILABILITY.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of the enactment of this Act and annually 
thereafter, the Secretary shall publish on a publicly 
available website of the Department of Homeland 
Security the information disclosed under subsection 
(b) during the preceding 1-year period, including the 
total dollar amount of ransoms paid by covered enti-
ties during such period. 
(2) EXCLUSION
OF
IDENTIFYING
INFORMA-
TION.—Information that reveals the identity of a 
covered entity that made a disclosure under sub-
VerDate Sep 11 2014 
02:11 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5501.IH
H5501
pbinns on DSKJLVW7X2PROD with BILLS
section (b) shall be excluded from the information 
published under paragraph (1). 
(f) STUDY AND REPORT ON RANSOM COMMONAL-
ITIES.— 
(1) STUDY.—The Secretary shall conduct a 
study to determine— 
(A) if there are commonalities with respect 
to the information disclosed under subsection 
(b); and 
(B) the extent to which cryptocurrency has 
facilitated the kinds of attacks that resulted in 
the payment of ransoms by covered entities. 
(2) REPORT.—Not later than 15 months after 
the date of the enactment of this Act, the Secretary 
shall submit to Congress a report that includes— 
(A) the findings of the study conducted 
under paragraph (1); and 
(B) such recommendations as the Sec-
retary considers appropriate for protecting the 
information systems of covered entities. 
(g) INDIVIDUAL REPORTING.— 
(1) IN GENERAL.—Not later than 60 days after 
the date of enactment of this Act, the Secretary 
shall establish a website through which individuals 
VerDate Sep 11 2014 
02:11 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5501.IH
H5501
pbinns on DSKJLVW7X2PROD with BILLS
may voluntarily report the payment of a ransom by 
the individual. 
(2) INCORPORATION OF DATA.—To the greatest 
extent practicable, the Secretary shall incorporate 
data from reporting by individuals under paragraph 
(1) in— 
(A) the information published under sub-
section (e); and 
(B) the study conducted under subsection 
(f). 
(h) APPLICABILITY.—This section shall apply to ran-
soms paid on or after the date that is 90 days after the 
date of the enactment of this Act. 
Æ 
VerDate Sep 11 2014 
02:11 Oct 08, 2021
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H5501.IH
H5501
pbinns on DSKJLVW7X2PROD with BILLS