I 
115TH CONGRESS 
1ST SESSION H. R. 2807 
To amend title 10, United States Code, to require congressional notification 
concerning sensitive military cyber operations and cyber weapons, and 
for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 7, 2017 
Mr. THORNBERRY (for himself, Mr. SMITH of Washington, Ms. STEFANIK, 
and Mr. LANGEVIN) introduced the following bill; which was referred to 
the Committee on Armed Services 
A BILL 
To amend title 10, United States Code, to require congres-
sional notification concerning sensitive military cyber op-
erations and cyber weapons, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. NOTIFICATION REQUIREMENTS FOR SENSITIVE 
MILITARY CYBER OPERATIONS AND CYBER 
WEAPONS. 
(a) NOTIFICATION.—Chapter 3 of title 10, United 
States Code, is amended by adding at the end the fol-
lowing new sections: 
VerDate Sep 11 2014 
04:41 Jun 13, 2017
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2807.IH
H2807
rfrederick on DSK3GLQ082PROD with BILLS
‘‘§ 130j. Notification requirements for sensitive mili-
tary cyber operations 
‘‘(a) IN GENERAL.—Except as provided in subsection 
(d), the Secretary of Defense shall promptly submit to the 
congressional defense committees notice in writing of any 
sensitive military cyber operation conducted under this 
title no later than 48 hours following such operation. 
‘‘(b) PROCEDURES.—(1) The Secretary of Defense 
shall establish and submit to the congressional defense 
committees procedures for complying with the require-
ments of subsection (a) consistent with the national secu-
rity of the United States and the protection of operational 
integrity. The Secretary shall promptly notify the congres-
sional defense committees in writing of any changes to 
such procedures at least 14 days prior to the adoption of 
any such changes. 
‘‘(2) The congressional defense committees shall en-
sure that committee procedures designed to protect from 
unauthorized disclosure classified information relating to 
national security of the United States are sufficient to pro-
tect the information that is submitted to the committees 
pursuant to this section. 
‘‘(3) In the event of an unauthorized disclosure of a 
sensitive military cyber operation covered by this section, 
the Secretary shall ensure, to the maximum extent prac-
ticable, that the congressional defense committees are no-
VerDate Sep 11 2014 
04:41 Jun 13, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2807.IH
H2807
rfrederick on DSK3GLQ082PROD with BILLS
tified immediately of the sensitive military cyber operation 
concerned. The notification under this paragraph may be 
verbal or written, but in the event of a verbal notification 
a written notification shall be provided by not later than 
48 hours after the provision of the verbal notification. 
‘‘(c) SENSITIVE MILITARY CYBER OPERATION DE-
FINED.—(1) In this section, the term ‘sensitive military 
cyber operation’ means an action described in paragraph 
(2) that— 
‘‘(A) is carried out by the armed forces or by 
a foreign partner in coordination with the armed 
forces; and 
‘‘(B) is intended to cause effects outside a geo-
graphic location where United States armed forces 
are involved in hostilities (as that term is used in 
section 1543 of title 50, United States Code). 
‘‘(2) The actions described in this paragraph are the 
following: 
‘‘(A) An offensive cyber operation. 
‘‘(B) A defensive cyber operation outside the 
Department of Defense Information Networks to de-
feat an ongoing or imminent threat. 
‘‘(d) EXCEPTIONS.—The notification requirement 
under subsection (a) does not apply— 
VerDate Sep 11 2014 
04:41 Jun 13, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2807.IH
H2807
rfrederick on DSK3GLQ082PROD with BILLS
‘‘(1) to a training exercise conducted with the 
consent of all nations where the intended effects of 
the exercise will occur; or 
‘‘(2) to a covert action (as that term is defined 
in section 3093 of title 50, United States Code). 
‘‘(e) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to provide any new authority or 
to alter or otherwise affect the War Powers Resolution (50 
U.S.C. 1541 et seq.), the Authorization for Use of Military 
Force (Public Law 107–40; 50 U.S.C. 1541 note), or any 
requirement under the National Security Act of 1947 (50 
U.S.C. 3001 et seq.). 
‘‘§ 130k. Notification requirements for cyber weapons 
‘‘(a) IN GENERAL.—Except as provided in subsection 
(c), the Secretary of Defense shall promptly submit to the 
congressional defense committees notice in writing of the 
following: 
‘‘(1) With respect to a cyber capability that is 
intended for use as a weapon, the results of any re-
view of the capability for legality under international 
law pursuant to Department of Defense Directive 
5000.01 no later than 48 hours after any military 
department concerned has completed such review. 
‘‘(2) The use as a weapon of any cyber capa-
bility that has been approved for such use under 
VerDate Sep 11 2014 
04:41 Jun 13, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2807.IH
H2807
rfrederick on DSK3GLQ082PROD with BILLS
international law by a military department no later 
than 48 hours following such use. 
‘‘(b) PROCEDURES.—(1) The Secretary of Defense 
shall establish and submit to the congressional defense 
committees procedures for complying with the require-
ments of subsection (a) consistent with the national secu-
rity of the United States and the protection of operational 
integrity. The Secretary shall promptly notify the congres-
sional defense committees in writing of any changes to 
such procedures at least 14 days prior to the adoption of 
any such changes. 
‘‘(2) The congressional defense committees shall en-
sure that committee procedures designed to protect from 
unauthorized disclosure classified information relating to 
national security of the United States are sufficient to pro-
tect the information that is submitted to the committees 
pursuant to this section. 
‘‘(3) In the event of an unauthorized disclosure of a 
cyber capability covered by this section, the Secretary shall 
ensure, to the maximum extent practicable, that the con-
gressional defense committees are notified immediately of 
the cyber capability concerned. The notification under this 
paragraph may be verbal or written, but in the event of 
a verbal notification a written notification shall be pro-
VerDate Sep 11 2014 
04:41 Jun 13, 2017
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2807.IH
H2807
rfrederick on DSK3GLQ082PROD with BILLS
vided by not later than 48 hours after the provision of 
the verbal notification. 
‘‘(c) EXCEPTIONS.—The notification requirement 
under subsection (a) does not apply— 
‘‘(1) to a training exercise conducted with the 
consent of all nations where the intended effects of 
the exercise will occur; or 
‘‘(2) to a covert action (as that term is defined 
in section 3093 of title 50, United States Code). 
‘‘(d) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to provide any new authority or 
to alter or otherwise affect the War Powers Resolution (50 
U.S.C. 1541 et seq.), the Authorization for Use of Military 
Force (Public Law 107–40; 50 U.S.C. 1541 note), or any 
requirement under the National Security Act of 1947 (50 
U.S.C. 3001 et seq.).’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by adding 
at the end the following new items: 
‘‘130j. Notification requirements for sensitive military cyber operations. 
‘‘130k. Notification requirements for cyber weapons.’’. 
Æ 
VerDate Sep 11 2014 
04:41 Jun 13, 2017
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6301
E:\BILLS\H2807.IH
H2807
rfrederick on DSK3GLQ082PROD with BILLS