1030, and 3559(c)(2)(F) and chapters 37 
and 90 of title 18, United States Code. 
(B) PROHIBITED
ACTIVITIES.—A cyber 
threat indicator or defensive measure provided 
to the Federal Government under this title shall 
not be disclosed to, retained by, or used by any 
Federal department or agency for any use not 
permitted under subparagraph (A). 
(C) PRIVACY
AND
CIVIL
LIBERTIES.—A 
cyber threat indicator or defensive measure pro-
vided to the Federal Government under this 
title shall be retained, used, and disseminated 
by the Federal Government in accordance 
with— 
(i) the policies and procedures relating 
to the receipt of cyber threat indicators 
and defensive measures by the Federal 
Government required by subsection (b) of 
section 111 of the National Security Act of 
1947, as added by subsection (a) of this 
section; and 
(ii) the privacy and civil liberties 
guidelines required by subsection (b).
SEC. 105. FEDERAL GOVERNMENT LIABILITY FOR VIOLA-
TIONS OF PRIVACY OR CIVIL LIBERTIES. 
(a) IN GENERAL.—If a department or agency of the 
Federal Government intentionally or willfully violates the 
privacy and civil liberties guidelines issued by the Attorney 
General under section 104(b), the United States shall be 
liable to a person injured by such violation in an amount 
equal to the sum of— 
(1) the actual damages sustained by the person 
as a result of the violation or $1,000, whichever is 
greater; and 
(2) reasonable attorney fees as determined by 
the court and other litigation costs reasonably in-
curred in any case under this subsection in which 
the complainant has substantially prevailed. 
(b) VENUE.—An action to enforce liability created 
under this section may be brought in the district court 
of the United States in— 
(1) the district in which the complainant re-
sides; 
(2) the district in which the principal place of 
business of the complainant is located; 
(3) the district in which the department or 
agency of the Federal Government that violated such 
privacy and civil liberties guidelines is located; or 
(4) the District of Columbia.
(c) STATUTE OF LIMITATIONS.—No action shall lie 
under this section unless such action is commenced not 
later than 2 years after the date on which the cause of 
action arises. 
(d) EXCLUSIVE CAUSE OF ACTION.—A cause of ac-
tion under this section shall be the exclusive means avail-
able to a complainant seeking a remedy for a violation by 
a department or agency of the Federal Government under 
this title. 
SEC. 106. PROTECTION FROM LIABILITY. 
(a) MONITORING OF INFORMATION SYSTEMS.—No 
cause of action shall lie or be maintained in any court 
against any private entity, and such action shall be 
promptly dismissed, for the monitoring of an information 
system and information under section 103(a) that is con-
ducted in accordance with this title and the amendments 
made by this title. 
(b) SHARING OR RECEIPT OF CYBER THREAT INDI-
CATORS.—No cause of action shall lie or be maintained 
in any court against any non-Federal entity, and such ac-
tion shall be promptly dismissed, for the sharing or receipt 
of a cyber threat indicator or defensive measure under sec-
tion 103(c), or a good faith failure to act based on such 
sharing or receipt, if such sharing or receipt is conducted
in accordance with this title and the amendments made 
by this title. 
(c) WILLFUL MISCONDUCT.— 
(1) RULE OF CONSTRUCTION.—Nothing in this 
section shall be construed— 
(A) to require dismissal of a cause of ac-
tion against a non-Federal entity (including a 
private entity) that has engaged in willful mis-
conduct in the course of conducting activities 
authorized by this title or the amendments 
made by this title; or 
(B) to undermine or limit the availability 
of otherwise applicable common law or statu-
tory defenses. 
(2) PROOF OF WILLFUL MISCONDUCT.—In any 
action claiming that subsection (a) or (b) does not 
apply due to willful misconduct described in para-
graph (1), the plaintiff shall have the burden of 
proving by clear and convincing evidence the willful 
misconduct by each non-Federal entity subject to 
such claim and that such willful misconduct proxi-
mately caused injury to the plaintiff. 
(3) WILLFUL MISCONDUCT DEFINED.—In this 
subsection, the term ‘‘willful misconduct’’ means an 
act or omission that is taken—
(A) intentionally to achieve a wrongful 
purpose; 
(B) knowingly without legal or factual jus-
tification; and 
(C) in disregard of a known or obvious risk 
that is so great as to make it highly probable 
that the harm will outweigh the benefit. 
SEC. 107. OVERSIGHT OF GOVERNMENT ACTIVITIES. 
(a) BIENNIAL REPORT ON IMPLEMENTATION.— 
(1) IN GENERAL.—Section 111 of the National 
Security Act of 1947, as added by section 102(a) 
and amended by section 104(a) of this title, is fur-
ther amended— 
(A) by redesignating subsection (c) (as re-
designated by such section 104(a)) as sub-
section (d); and 
(B) by inserting after subsection (b) (as 
inserted by such section 104(a)) the following 
new subsection: 
‘‘(c) BIENNIAL REPORT ON IMPLEMENTATION.— 
‘‘(1) IN GENERAL.—Not less frequently than 
once every two years, the Director of National Intel-
ligence, in consultation with the heads of the other 
appropriate Federal entities, shall submit to Con-
gress a report concerning the implementation of this 
section and the Protecting Cyber Networks Act. 
‘‘(2) CONTENTS.—Each report submitted under 
paragraph (1) shall include the following: 
‘‘(A) An assessment of the sufficiency of 
the policies, procedures, and guidelines required 
by this section and section 4 of the Protecting 
Cyber Networks Act in ensuring that cyber 
threat indicators are shared effectively and re-
sponsibly within the Federal Government. 
‘‘(B) An assessment of whether the proce-
dures developed under section 3 of such Act 
comply with the goals described in subpara-
graphs (A), (B), and (C) of subsection (a)(1). 
‘‘(C) An assessment of whether cyber 
threat indicators have been properly classified 
and an accounting of the number of security 
clearances authorized by the Federal Govern-
ment for the purposes of this section and such 
Act. 
‘‘(D) A review of the type of cyber threat 
indicators shared with the Federal Government 
under this section and such Act, including the 
following:
‘‘(i) The degree to which such infor-
mation may impact the privacy and civil 
liberties of specific persons. 
‘‘(ii) A quantitative and qualitative as-
sessment of the impact of the sharing of 
such cyber threat indicators with the Fed-
eral Government on privacy and civil lib-
erties of specific persons. 
‘‘(iii) The adequacy of any steps taken 
by the Federal Government to reduce such 
impact. 
‘‘(E) A review of actions taken by the Fed-
eral Government based on cyber threat indica-
tors shared with the Federal Government under 
this section or such Act, including the appro-
priateness of any subsequent use or dissemina-
tion of such cyber threat indicators by a Fed-
eral entity under this section or section 4 of 
such Act. 
‘‘(F) A description of any significant viola-
tions of the requirements of this section or such 
Act by the Federal Government— 
‘‘(i) an assessment of all reports of of-
ficers, employees, and agents of the Fed-
eral Government misusing information pro-
vided to the Federal Government under the 
Protecting Cyber Networks Act or this sec-
tion, without regard to whether the misuse 
was knowing or wilful; and 
‘‘(ii) an assessment of all disciplinary 
actions taken against such officers, em-
ployees, and agents. 
‘‘(G) A summary of the number and type 
of non-Federal entities that received classified 
cyber threat indicators from the Federal Gov-
ernment under this section or such Act and an 
evaluation of the risks and benefits of sharing 
such cyber threat indicators. 
‘‘(H) An assessment of any personal infor-
mation of or information identifying a specific 
person not directly related to a cybersecurity 
threat that— 
‘‘(i) was shared by a non-Federal enti-
ty with the Federal Government under this 
Act in contravention of section 3(d)(2) of 
such Act; or 
‘‘(ii) was shared within the Federal 
Government under this Act in contraven-
tion of the guidelines required by section 
4(b) of such Act.
‘‘(3) RECOMMENDATIONS.—Each report sub-
mitted under paragraph (1) may include such rec-
ommendations as the heads of the appropriate Fed-
eral entities may have for improvements or modifica-
tions to the authorities and processes under this sec-
tion or such Act. 
‘‘(4) FORM OF REPORT.—Each report required 
by paragraph (1) shall be submitted in unclassified 
form, but may include a classified annex. 
‘‘(5) PUBLIC AVAILABILITY OF REPORTS.—The 
Director of National Intelligence shall make publicly 
available the unclassified portion of each report re-
quired by paragraph (1).’’. 
(2) INITIAL REPORT.—The first report required 
under subsection (c) of section 111 of the National 
Security Act of 1947, as inserted by paragraph (1) 
of this subsection, shall be submitted not later than 
1 year after the date of the enactment of this title. 
(b) REPORTS ON PRIVACY AND CIVIL LIBERTIES.— 
(1) BIENNIAL
REPORT
FROM
PRIVACY
AND 
CIVIL LIBERTIES OVERSIGHT BOARD.— 
(A) IN GENERAL.—Section 1061(e) of the 
Intelligence Reform and Terrorism Prevention 
Act of 2004 (42 U.S.C. 2000ee(e)) is amended
by adding at the end the following new para-
graph: 
‘‘(3) BIENNIAL REPORT ON CERTAIN CYBER AC-
TIVITIES.— 
‘‘(A) REPORT
REQUIRED.—The Privacy 
and Civil Liberties Oversight Board shall bien-
nially submit to Congress and the President a 
report containing— 
‘‘(i) an assessment of the privacy and 
civil liberties impact of the activities car-
ried out under the Protecting Cyber Net-
works Act and the amendments made by 
such Act; and 
‘‘(ii) an assessment of the sufficiency 
of the policies, procedures, and guidelines 
established pursuant to section 4 of the 
Protecting Cyber Networks Act and the 
amendments made by such section 4 in ad-
dressing privacy and civil liberties con-
cerns. 
‘‘(B) RECOMMENDATIONS.—Each report 
submitted under this paragraph may include 
such recommendations as the Privacy and Civil 
Liberties Oversight Board may have for im-
provements or modifications to the authorities
under the Protecting Cyber Networks Act or 
the amendments made by such Act. 
‘‘(C) FORM.—Each report required under 
this paragraph shall be submitted in unclassi-
fied form, but may include a classified annex. 
‘‘(D) 
PUBLIC
AVAILABILITY
OF
RE-
PORTS.—The Privacy and Civil Liberties Over-
sight Board shall make publicly available the 
unclassified portion of each report required by 
subparagraph (A).’’. 
(B) INITIAL REPORT.—The first report re-
quired under paragraph (3) of section 1061(e) 
of the Intelligence Reform and Terrorism Pre-
vention Act of 2004 (42 U.S.C. 2000ee(e)), as 
added by subparagraph (A) of this paragraph, 
shall be submitted not later than 2 years after 
the date of the enactment of this title. 
(2) BIENNIAL
REPORT
OF
INSPECTORS
GEN-
ERAL.— 
(A) IN GENERAL.—Not later than 2 years 
after the date of the enactment of this title and 
not less frequently than once every 2 years 
thereafter, the Inspector General of the Depart-
ment of Homeland Security, the Inspector Gen-
eral of the Intelligence Community, the Inspec-
tor General of the Department of Justice, and 
the Inspector General of the Department of De-
fense, in consultation with the Council of In-
spectors General on Financial Oversight, shall 
jointly submit to Congress a report on the re-
ceipt, use, and dissemination of cyber threat in-
dicators and defensive measures that have been 
shared with Federal entities under this title and 
the amendments made by this title. 
(B) CONTENTS.—Each report submitted 
under subparagraph (A) shall include the fol-
lowing: 
(i) A review of the types of cyber 
threat indicators shared with Federal enti-
ties. 
(ii) A review of the actions taken by 
Federal entities as a result of the receipt 
of such cyber threat indicators. 
(iii) A list of Federal entities receiving 
such cyber threat indicators. 
(iv) A review of the sharing of such 
cyber threat indicators among Federal en-
tities to identify inappropriate barriers to 
sharing information.
(v) A review of the current procedures 
pertaining to the sharing of information, 
removal procedures for personal informa-
tion or information identifying a specific 
person, and any incidents pertaining to the 
improper treatment of such information. 
(C) 
RECOMMENDATIONS.—Each 
report 
submitted under this paragraph may include 
such recommendations as the Inspectors Gen-
eral referred to in subparagraph (A) may have 
for improvements or modifications to the au-
thorities under this title or the amendments 
made by this title. 
(D) FORM.—Each report required under 
this paragraph shall be submitted in unclassi-
fied form, but may include a classified annex. 
(E) PUBLIC AVAILABILITY OF REPORTS.— 
The Inspector General of the Department of 
Homeland Security, the Inspector General of 
the Intelligence Community, the Inspector Gen-
eral of the Department of Justice, and the In-
spector General of the Department of Defense 
shall make publicly available the unclassified 
portion of each report required under subpara-
graph (A).
SEC. 108. REPORT ON CYBERSECURITY THREATS. 
(a) REPORT REQUIRED.—Not later than 180 days 
after the date of the enactment of this title, the Director 
of National Intelligence, in consultation with the heads of 
other appropriate elements of the intelligence community, 
shall submit to the Select Committee on Intelligence of 
the Senate and the Permanent Select Committee on Intel-
ligence of the House of Representatives a report on cyber-
security threats to the national security and economy of 
the United States, including cyber attacks, theft, and data 
breaches. 
(b) CONTENTS.—The report required by subsection 
(a) shall include the following: 
(1) An assessment of— 
(A) the current intelligence sharing and co-
operation relationships of the United States 
with other countries regarding cybersecurity 
threats (including cyber attacks, theft, and data 
breaches) directed against the United States 
that threaten the United States national secu-
rity interests, economy, and intellectual prop-
erty; and 
(B) the relative utility of such relation-
ships, which elements of the intelligence com-
munity participate in such relationships, and
whether and how such relationships could be 
improved. 
(2) A list and an assessment of the countries 
and non-state actors that are the primary threats of 
carrying out a cybersecurity threat (including a 
cyber attack, theft, or data breach) against the 
United States and that threaten the United States 
national security, economy, and intellectual property. 
(3) A description of the extent to which the ca-
pabilities of the United States Government to re-
spond to or prevent cybersecurity threats (including 
cyber attacks, theft, or data breaches) directed 
against the United States private sector are de-
graded by a delay in the prompt notification by pri-
vate entities of such threats or cyber attacks, theft, 
and breaches. 
(4) An assessment of additional technologies or 
capabilities that would enhance the ability of the 
United States to prevent and to respond to cyberse-
curity threats (including cyber attacks, theft, and 
data breaches). 
(5) An assessment of any technologies or prac-
tices utilized by the private sector that could be rap-
idly fielded to assist the intelligence community in 
preventing and responding to cybersecurity threats.
(c) FORM OF REPORT.—The report required by sub-
section (a) shall be submitted in unclassified form, but 
may include a classified annex. 
(d) PUBLIC AVAILABILITY OF REPORT.—The Direc-
tor of National Intelligence shall make publicly available 
the unclassified portion of the report required by sub-
section (a). 
(e) INTELLIGENCE COMMUNITY DEFINED.—In this 
section, the term ‘‘intelligence community’’ has the mean-
ing given that term in section 3 of the National Security 
Act of 1947 (50 U.S.C. 3003). 
SEC. 109. CONSTRUCTION AND PREEMPTION. 
(a) PROHIBITION OF SURVEILLANCE.—Nothing in 
this title or the amendments made by this title shall be 
construed to authorize the Department of Defense or the 
National Security Agency or any other element of the in-
telligence community to target a person for surveillance. 
(b) OTHERWISE LAWFUL DISCLOSURES.—Nothing in 
this title or the amendments made by this title shall be 
construed to limit or prohibit— 
(1) otherwise lawful disclosures of communica-
tions, records, or other information, including re-
porting of known or suspected criminal activity, by 
a non-Federal entity to any other non-Federal entity 
or the Federal Government; or
(2) any otherwise lawful use of such disclosures 
by any entity of the Federal Government, without 
regard to whether such otherwise lawful disclosures 
duplicate or replicate disclosures made under this 
title. 
(c) WHISTLE BLOWER PROTECTIONS.—Nothing in 
this title or the amendments made by this title shall be 
construed to prohibit or limit the disclosure of information 
protected under section 2302(b)(8) of title 5, United 
States Code (governing disclosures of illegality, waste, 
fraud, abuse, or public health or safety threats), section 
7211 of title 5, United States Code (governing disclosures 
to Congress), section 1034 of title 10, United States Code 
(governing disclosure to Congress by members of the mili-
tary), or any similar provision of Federal or State law. 
(d) PROTECTION
OF SOURCES
AND METHODS.— 
Nothing in this title or the amendments made by this title 
shall be construed— 
(1) as creating any immunity against, or other-
wise affecting, any action brought by the Federal 
Government, or any department or agency thereof, 
to enforce any law, Executive order, or procedure 
governing the appropriate handling, disclosure, or 
use of classified information;
(2) to affect the conduct of authorized law en-
forcement or intelligence activities; or 
(3) to modify the authority of the President or 
a department or agency of the Federal Government 
to protect and control the dissemination of classified 
information, intelligence sources and methods, and 
the national security of the United States. 
(e) RELATIONSHIP TO OTHER LAWS.—Nothing in 
this title or the amendments made by this title shall be 
construed to affect any requirement under any other pro-
vision of law for a non-Federal entity to provide informa-
tion to the Federal Government. 
(f) INFORMATION SHARING RELATIONSHIPS.—Noth-
ing in this title or the amendments made by this title shall 
be construed— 
(1) to limit or modify an existing information- 
sharing relationship; 
(2) to prohibit a new information-sharing rela-
tionship; or 
(3) to require a new information-sharing rela-
tionship between any non-Federal entity and the 
Federal Government. 
(g) PRESERVATION OF CONTRACTUAL OBLIGATIONS 
AND RIGHTS.—Nothing in this title or the amendments 
made by this title shall be construed—
(j) USE AND RETENTION OF INFORMATION.—Noth-
ing in this title or the amendments made by this title shall 
be construed to authorize, or to modify any existing au-
thority of, a department or agency of the Federal Govern-
ment to retain or use any information shared under this 
title or the amendments made by this title for any use 
other than permitted in this title or the amendments made 
by this title. 
(k) FEDERAL PREEMPTION.— 
(1) IN GENERAL.—This title and the amend-
ments made by this title supersede any statute or 
other provision of law of a State or political subdivi-
sion of a State that restricts or otherwise expressly 
regulates an activity authorized under this title or 
the amendments made by this title. 
(2) STATE
LAW
ENFORCEMENT.—Nothing in 
this title or the amendments made by this title shall 
be construed to supersede any statute or other provi-
sion of law of a State or political subdivision of a 
State concerning the use of authorized law enforce-
ment practices and procedures. 
(3) STATE REGULATION OF UTILITIES.—Except 
as provided by section 103(d)(4)(B), nothing in this 
title or the amendments made by this title shall be 
construed to supersede any statute, regulation, or
other provision of law of a State or political subdivi-
sion of a State relating to the regulation of a private 
entity performing utility services, except to the ex-
tent such statute, regulation, or other provision of 
law restricts activity authorized under this title or 
the amendments made by this title. 
(l) REGULATORY AUTHORITY.—Nothing in this title 
or the amendments made by this title shall be construed— 
(1) to authorize the promulgation of any regu-
lations not specifically authorized by this title or the 
amendments made by this title; 
(2) to establish any regulatory authority not 
specifically established under this title or the amend-
ments made by this title; or 
(3) to authorize regulatory actions that would 
duplicate or conflict with regulatory requirements, 
mandatory standards, or related processes under an-
other provision of Federal law. 
SEC. 110. DEFINITIONS. 
In this title: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given the term in section 3502 of title 44, 
United States Code.
(2) APPROPRIATE
FEDERAL
ENTITIES.—The 
term ‘‘appropriate Federal entities’’ means the fol-
lowing: 
(A) The Department of Commerce. 
(B) The Department of Defense. 
(C) The Department of Energy. 
(D) The Department of Homeland Secu-
rity. 
(E) The Department of Justice. 
(F) The Department of the Treasury. 
(G) The Office of the Director of National 
Intelligence. 
(3) CYBERSECURITY PURPOSE.—The term ‘‘cy-
bersecurity purpose’’ means the purpose of pro-
tecting (including through the use of a defensive 
measure) an information system or information that 
is stored on, processed by, or transiting an informa-
tion system from a cybersecurity threat or security 
vulnerability or identifying the source of a cyberse-
curity threat. 
(4) CYBERSECURITY THREAT.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘cybersecurity 
threat’’ means an action, not protected by the 
first amendment to the Constitution of the
United States, on or through an information 
system that may result in an unauthorized ef-
fort to adversely impact the security, confiden-
tiality, integrity, or availability of an informa-
tion system or information that is stored on, 
processed by, or transiting an information sys-
tem. 
(B) EXCLUSION.—The term ‘‘cybersecurity 
threat’’ does not include any action that solely 
involves a violation of a consumer term of serv-
ice or a consumer licensing agreement. 
(5) CYBER
THREAT
INDICATOR.—The term 
‘‘cyber threat indicator’’ means information or a 
physical object that is necessary to describe or iden-
tify— 
(A) malicious reconnaissance, including 
anomalous patterns of communications that ap-
pear to be transmitted for the purpose of gath-
ering technical information related to a cyberse-
curity threat or security vulnerability; 
(B) a method of defeating a security con-
trol or exploitation of a security vulnerability; 
(C) a security vulnerability, including 
anomalous activity that appears to indicate the 
existence of a security vulnerability;
(8) INFORMATION SYSTEM.—The term ‘‘infor-
mation system’’— 
(A) has the meaning given the term in sec-
tion 3502 of title 44, United States Code; and 
(B) includes industrial control systems, 
such as supervisory control and data acquisition 
systems, distributed control systems, and pro-
grammable logic controllers. 
(9) LOCAL
GOVERNMENT.—The term ‘‘local 
government’’ means any borough, city, county, par-
ish, town, township, village, or other political sub-
division of a State. 
(10) MALICIOUS
CYBER
COMMAND
AND
CON-
TROL.—The term ‘‘malicious cyber command and 
control’’ means a method for unauthorized remote 
identification of, access to, or use of, an information 
system or information that is stored on, processed 
by, or transiting an information system. 
(11) MALICIOUS RECONNAISSANCE.—The term 
‘‘malicious reconnaissance’’ means a method for ac-
tively probing or passively monitoring an information 
system for the purpose of discerning security 
vulnerabilities of the information system, if such 
method is associated with a known or suspected cy-
bersecurity threat.
(12) MONITOR.—The term ‘‘monitor’’ means to 
acquire, identify, scan, or otherwise possess informa-
tion that is stored on, processed by, or transiting an 
information system. 
(13) NON-FEDERAL ENTITY.— 
(A) IN
GENERAL.—Except as otherwise 
provided in this paragraph, the term ‘‘non-Fed-
eral entity’’ means any private entity, non-Fed-
eral Government department or agency, or 
State, tribal, or local government (including a 
political subdivision, department, officer, em-
ployee, or agent thereof). 
(B) INCLUSIONS.—The term ‘‘non-Federal 
entity’’ includes a government department or 
agency (including an officer, employee, or agent 
thereof) of the District of Columbia, the Com-
monwealth of Puerto Rico, the Virgin Islands, 
Guam, American Samoa, the Northern Mariana 
Islands, and any other territory or possession of 
the United States. 
(C) EXCLUSION.—The term ‘‘non-Federal 
entity’’ does not include a foreign power or 
known agent of a foreign power, as both terms 
are defined in section 101 of the Foreign Intel-
ligence Surveillance Act of 1978 (50 U.S.C. 
1801). 
(14) PRIVATE ENTITY.— 
(A) IN
GENERAL.—Except as otherwise 
provided in this paragraph, the term ‘‘private 
entity’’ means any person or private group, or-
ganization, proprietorship, partnership, trust, 
cooperative, corporation, or other commercial or 
nonprofit entity, including an officer, employee, 
or agent thereof. 
(B) INCLUSION.—The term ‘‘private enti-
ty’’ includes a component of a State, tribal, or 
local government performing utility services. 
(C) EXCLUSION.—The term ‘‘private enti-
ty’’ does not include a foreign power as defined 
in section 101 of the Foreign Intelligence Sur-
veillance Act of 1978 (50 U.S.C. 1801). 
(15) REAL TIME; REAL-TIME.—The terms ‘‘real 
time’’ and ‘‘real-time’’ mean a process by which an 
automated, machine-to-machine system processes 
cyber threat indicators such that the time in which 
the occurrence of an event and the reporting or re-
cording of it are as simultaneous as technologically 
and operationally practicable.
(16) SECURITY CONTROL.—The term ‘‘security 
control’’ means the management, operational, and 
technical controls used to protect against an unau-
thorized effort to adversely impact the security, con-
fidentiality, integrity, and availability of an informa-
tion system or its information. 
(17) SECURITY
VULNERABILITY.—The term 
‘‘security vulnerability’’ means any attribute of hard-
ware, software, process, or procedure that could en-
able or facilitate the defeat of a security control. 
(18) TRIBAL.—The term ‘‘tribal’’ has the 
meaning given the term ‘‘Indian tribe’’ in section 4 
of the Indian Self-Determination and Education As-
sistance Act (25 U.S.C. 450b). 
SEC. 111. COMPTROLLER GENERAL REPORT ON REMOVAL 
OF PERSONAL IDENTIFYING INFORMATION. 
(a) REPORT.—Not later than 3 years after the date 
of the enactment of this title, the Comptroller General of 
the United States shall submit to Congress a report on 
the actions taken by the Federal Government to remove 
personal information from cyber threat indicators pursu-
ant to section 104(b). 
(b) FORM.—The report under subsection (a) shall be 
submitted in unclassified form, but may include a classi-
fied annex.
SEC. 112. SUNSET. 
This title and the amendments made by this title 
shall terminate on the date that is 7 years after the date 
of the enactment of this title. 
TITLE II—NATIONAL CYBERSE-
CURITY 
PROTECTION 
AD-
VANCEMENT ACT 
SEC. 201. SHORT TITLE. 
This title may be cited as the ‘‘National Cybersecu-
rity Protection Advancement Act of 2015’’. 
SEC. 202. NATIONAL CYBERSECURITY AND COMMUNICA-
TIONS INTEGRATION CENTER. 
(a) IN GENERAL.—Subsection (a) of the second sec-
tion 226 of the Homeland Security Act of 2002 (6 U.S.C. 
148; relating to the National Cybersecurity and Commu-
nications Integration Center) is amended— 
(1) by amending paragraph (1) to read as fol-
lows: 
‘‘(1)(A) except as provided in subparagraph 
(B), the term ‘cybersecurity risk’ means threats to 
and vulnerabilities of information or information sys-
tems and any related consequences caused by or re-
sulting from unauthorized access, use, disclosure, 
degradation, disruption, modification, or destruction 
of such information or information systems, includ-
ing such related consequences caused by an act of 
terrorism; 
‘‘(B) such term does not include any action that 
solely involves a violation of a consumer term of 
service or a consumer licensing agreement;’’. 
(2) by amending paragraph (2) to read as fol-
lows: 
‘‘(2) the term ‘incident’ means an occurrence 
that actually or imminently jeopardizes, without law-
ful authority, the integrity, confidentiality, or avail-
ability of information on an information system, or 
actually or imminently jeopardizes, without lawful 
authority, an information system;’’. 
(3) in paragraph (3), by striking ‘‘and’’ at the 
end; 
(4) in paragraph (4), by striking the period at 
the end and inserting ‘‘; and’’; and 
(5) by adding at the end the following new 
paragraphs: 
‘‘(5) the term ‘cyber threat indicator’ means 
technical information that is necessary to describe or 
identify— 
‘‘(A) a method for probing, monitoring, 
maintaining, or establishing network awareness 
of an information system for the purpose of dis-
cerning technical vulnerabilities of such infor-
mation system, if such method is known or rea-
sonably suspected of being associated with a 
known or suspected cybersecurity risk, includ-
ing communications that reasonably appear to 
be transmitted for the purpose of gathering 
technical information related to a cybersecurity 
risk; 
‘‘(B) a method for defeating a technical or 
security control of an information system; 
‘‘(C) a technical vulnerability, including 
anomalous technical behavior that may become 
a vulnerability; 
‘‘(D) a method of causing a user with le-
gitimate access to an information system or in-
formation that is stored on, processed by, or 
transiting an information system to inadvert-
ently enable the defeat of a technical or oper-
ational control; 
‘‘(E) a method for unauthorized remote 
identification of, access to, or use of an infor-
mation system or information that is stored on, 
processed by, or transiting an information sys-
tem that is known or reasonably suspected of
being associated with a known or suspected cy-
bersecurity risk; 
‘‘(F) the actual or potential harm caused 
by a cybersecurity risk, including a description 
of the information exfiltrated as a result of a 
particular cybersecurity risk; 
‘‘(G) any other attribute of a cybersecurity 
risk that cannot be used to identify specific per-
sons reasonably believed to be unrelated to such 
cybersecurity risk, if disclosure of such at-
tribute is not otherwise prohibited by law; or 
‘‘(H) any combination of subparagraphs 
(A) through (G); 
‘‘(6) the term ‘cybersecurity purpose’ means the 
purpose of protecting an information system or in-
formation that is stored on, processed by, or 
transiting an information system from a cybersecu-
rity risk or incident, or the purpose of identifying 
the source of a cybersecurity risk or incident; 
‘‘(7)(A) except as provided in subparagraph 
(B), the term ‘defensive measure’ means an action, 
device, procedure, signature, technique, or other 
measure applied to an information system or infor-
mation that is stored on, processed by, or transiting 
an information system that detects, prevents, or
mitigates a known or suspected cybersecurity risk or 
incident, or any attribute of hardware, software, 
process, or procedure that could enable or facilitate 
the defeat of a security control; 
‘‘(B) such term does not include a measure that 
destroys, renders unusable, or substantially harms 
an information system or data on an information 
system not belonging to— 
‘‘(i) the non-Federal entity, not including a 
State, local, or tribal government, operating 
such measure; or 
‘‘(ii) another Federal entity or non-Federal 
entity that is authorized to provide consent and 
has provided such consent to the non-Federal 
entity referred to in clause (i); 
‘‘(8) the term ‘network awareness’ means to 
scan, identify, acquire, monitor, log, or analyze in-
formation that is stored on, processed by, or 
transiting an information system; 
‘‘(9)(A) the term ‘private entity’ means a non- 
Federal entity that is an individual or private group, 
organization, proprietorship, partnership, trust, co-
operative, corporation, or other commercial or non- 
profit entity, including an officer, employee, or agent 
thereof;
‘‘(B) such term includes a component of a 
State, local, or tribal government performing utility 
services or an entity performing utility services; 
‘‘(10) the term ‘security control’ means the 
management, operational, and technical controls 
used to protect against an unauthorized effort to ad-
versely affect the confidentially, integrity, or avail-
ability of an information system or information that 
is stored on, processed by, or transiting an informa-
tion system; and 
‘‘(11) the term ‘sharing’ (including all conjuga-
tions thereof) means providing, receiving, and dis-
seminating (including all conjugations of each of 
such terms).’’. 
(b) AMENDMENT.—Subparagraph (B) of subsection 
(d)(1) of such second section 226 of the Homeland Secu-
rity Act of 2002 is amended— 
(1) in clause (i), by striking ‘‘and local’’ and in-
serting ‘‘, local, and tribal’’; 
(2) in clause (ii)— 
(A) by inserting ‘‘, including information 
sharing and analysis centers’’ before the semi-
colon; and 
(B) by striking ‘‘and’’ at the end;
(3) in clause (iii), by inserting ‘‘and’’ after the 
semicolon at the end; and 
(4) by adding at the end the following new 
clause: 
‘‘(iv) private entities;’’. 
SEC. 203. INFORMATION SHARING STRUCTURE AND PROC-
ESSES. 
The second section 226 of the Homeland Security Act 
of 2002 (6 U.S.C. 148; relating to the National Cyberse-
curity and Communications Integration Center) is amend-
ed— 
(1) in subsection (c)— 
(A) in paragraph (1)— 
(i) by striking ‘‘a Federal civilian 
interface’’ and inserting ‘‘the lead Federal 
civilian interface’’; and 
(ii) by striking ‘‘cybersecurity risks,’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; 
(B) in paragraph (3), by striking ‘‘cyberse-
curity risks’’ and inserting ‘‘cyber threat indica-
tors, defensive measures, cybersecurity risks,’’; 
(C) in paragraph (5)(A), by striking ‘‘cy-
bersecurity risks’’ and inserting ‘‘cyber threat
indicators, defensive measures, cybersecurity 
risks,’’; 
(D) in paragraph (6)— 
(i) by striking ‘‘cybersecurity risks’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; 
and 
(ii) by striking ‘‘and’’ at the end; 
(E) in paragraph (7)— 
(i) in subparagraph (A), by striking 
‘‘and’’ at the end; 
(ii) in subparagraph (B), by striking 
the period at the end and inserting ‘‘; 
and’’; and 
(iii) by adding at the end the fol-
lowing new subparagraph: 
‘‘(C) sharing cyber threat indicators and 
defensive measures;’’; and 
(F) by adding at the end the following new 
paragraphs: 
‘‘(8) engaging with international partners, in 
consultation with other appropriate agencies, to— 
‘‘(A) collaborate on cyber threat indicators, 
defensive measures, and information related to 
cybersecurity risks and incidents; and
‘‘(B) enhance the security and resilience of 
global cybersecurity; 
‘‘(9) sharing cyber threat indicators, defensive 
measures, and other information related to cyberse-
curity risks and incidents with Federal and non-Fed-
eral entities, including across sectors of critical in-
frastructure and with State and major urban area 
fusion centers, as appropriate; 
‘‘(10) promptly notifying the Secretary and the 
Committee on Homeland Security of the House of 
Representatives and the Committee on Homeland 
Security and Governmental Affairs of the Senate of 
any significant violations of the policies and proce-
dures specified in subsection (i)(6)(A); 
‘‘(11) promptly notifying non-Federal entities 
that have shared cyber threat indicators or defensive 
measures that are known or determined to be in 
error or in contravention of the requirements of this 
section; and 
‘‘(12) participating, as appropriate, in exercises 
run by the Department’s National Exercise Pro-
gram.’’; 
(2) in subsection (d)(1)— 
(A) in subparagraph (D), by striking 
‘‘and’’ at the end;
(B) by redesignating subparagraph (E) as 
subparagraph (J); and 
(C) by inserting after subparagraph (D) 
the following new subparagraphs: 
‘‘(E) an entity that collaborates with State 
and local governments on cybersecurity risks 
and incidents, and has entered into a voluntary 
information sharing relationship with the Cen-
ter; 
‘‘(F) a United States Computer Emer-
gency Readiness Team that coordinates infor-
mation related to cybersecurity risks and inci-
dents, proactively and collaboratively addresses 
cybersecurity risks and incidents to the United 
States, collaboratively responds to cybersecurity 
risks and incidents, provides technical assist-
ance, upon request, to information system own-
ers and operators, and shares cyber threat indi-
cators, defensive measures, analysis, or infor-
mation related to cybersecurity risks and inci-
dents in a timely manner; 
‘‘(G) the Industrial Control System Cyber 
Emergency Response Team that— 
‘‘(i) coordinates with industrial con-
trol systems owners and operators;
‘‘(ii) provides training, upon request, 
to Federal entities and non-Federal enti-
ties on industrial control systems cyberse-
curity; 
‘‘(iii) collaboratively addresses cyber-
security risks and incidents to industrial 
control systems; 
‘‘(iv) provides technical assistance, 
upon request, to Federal entities and non- 
Federal entities relating to industrial con-
trol systems cybersecurity; 
‘‘(v) shares cyber threat indicators, 
defensive measures, or information related 
to cybersecurity risks and incidents of in-
dustrial control systems in a timely fash-
ion; and 
‘‘(vi) remains current on industrial 
control system innovation; industry adop-
tion of new technologies, and industry best 
practices; 
‘‘(H) a National Coordinating Center for 
Communications that coordinates the protec-
tion, response, and recovery of emergency com-
munications;
‘‘(I) an entity that coordinates with small 
and medium-sized businesses; and’’; 
(3) in subsection (e)— 
(A) in paragraph (1)— 
(i) in subparagraph (A), by inserting 
‘‘cyber threat indicators, defensive meas-
ures, and’’ before ‘‘information’’; 
(ii) in subparagraph (B), by inserting 
‘‘cyber threat indicators, defensive meas-
ures, and’’ before ‘‘information’’ the first 
place it appears; 
(iii) in subparagraph (F), by striking 
‘‘cybersecurity risks’’ and inserting ‘‘cyber 
threat indicators, defensive measures, cy-
bersecurity risks,’’; 
(iv) in subparagraph (F), by striking 
‘‘and’’ at the end; 
(v) in subparagraph (G), by striking 
‘‘cybersecurity risks’’ and inserting ‘‘cyber 
threat indicators, defensive measures, cy-
bersecurity risks,’’; and 
(vi) by adding at the end the fol-
lowing: 
‘‘(H) the Center ensures that it shares in-
formation relating to cybersecurity risks and in-
nications with a decisionmaking offi-
cial. 
‘‘(C) STATE, LOCAL, OR TRIBAL GOVERN-
MENT.— 
‘‘(i) 
USES
OF
INFORMATION.—A 
State, local, or tribal government that re-
ceives cyber threat indicators or defensive 
measures from the Center from a Federal 
entity or a non-Federal entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators 
or defensive measures solely for cyber-
security purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove or 
exclude information that can be used 
to identify specific persons and is rea-
sonably believed at the time of sharing 
to be unrelated to a cybersecurity risk 
or incident, and to safeguard informa-
tion that can be used to identify spe-
cific persons from unintended disclo-
sure or unauthorized access or acqui-
sition;