IB 
Union Calendar No. 25 
113TH CONGRESS 
1ST SESSION 
H. R. 624 
[Report No. 113–39] 
To provide for the sharing of certain cyber threat intelligence and cyber 
threat information between the intelligence community and cybersecurity 
entities, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 13, 2013 
Mr. ROGERS of Michigan (for himself and Mr. RUPPERSBERGER) introduced 
the following bill; which was referred to the Select Committee on Intel-
ligence (Permanent Select) 
APRIL 15, 2013 
Additional sponsors: Mr. MCCAUL, Mr. THORNBERRY, Mr. UPTON, Mr. WAL-
DEN, Mr. WESTMORELAND, Mr. NUNES, Mr. POMPEO, Mr. PETERS of 
California, Ms. SINEMA, Mr. LANCE, Mr. LOBIONDO, Mr. KING of New 
York, Mr. HECK
of Nevada, Mr. STIVERS, Mr. CONAWAY, Mr. 
MCHENRY, Mrs. MILLER of Michigan, Mr. GUTHRIE, Mr. KLINE, Mr. 
SCHOCK, Mr. MULVANEY, Mr. HASTINGS of Washington, Mr. CAMP, Mr. 
COLE, Mr. KINZINGER of Illinois, Mr. AMODEI, Mr. GRIFFIN of Arkan-
sas, Ms. SEWELL of Alabama, Mr. CUELLAR, Mr. COSTA, Mr. HASTINGS 
of Florida, Mr. KILMER, Mr. LIPINSKI, Mr. ENYART, Mr. GUTIERREZ, 
and Mr. VARGAS 
APRIL 15, 2013 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on February 13, 2013] 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber Intelligence Shar-
ing and Protection Act’’. 
SEC. 2. CYBER THREAT INTELLIGENCE AND INFORMATION 
SHARING. 
(a) IN GENERAL.—Title XI of the National Security 
Act of 1947 (50 U.S.C. 442 et seq.) is amended by adding 
at the end the following new section: 
‘‘CYBER THREAT INTELLIGENCE AND INFORMATION 
SHARING 
‘‘SEC. 1104. (a) INTELLIGENCE COMMUNITY SHARING 
OF CYBER THREAT INTELLIGENCE WITH PRIVATE SECTOR 
AND UTILITIES.— 
‘‘(1) IN GENERAL.—The Director of National In-
telligence shall establish procedures to allow elements 
of the intelligence community to share cyber threat 
intelligence with private-sector entities and utilities 
and to encourage the sharing of such intelligence. 
‘‘(2) SHARING AND USE OF CLASSIFIED INTEL-
LIGENCE.—The procedures established under para-
graph (1) shall provide that classified cyber threat in-
telligence may only be— 
‘‘(A) shared by an element of the intel-
ligence community with— 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(i) a certified entity; or 
‘‘(ii) a person with an appropriate se-
curity clearance to receive such cyber threat 
intelligence; 
‘‘(B) shared consistent with the need to pro-
tect the national security of the United States; 
and 
‘‘(C) used by a certified entity in a manner 
which protects such cyber threat intelligence from 
unauthorized disclosure. 
‘‘(3) SECURITY
CLEARANCE
APPROVALS.—The 
Director of National Intelligence shall issue guidelines 
providing that the head of an element of the intel-
ligence community may, as the head of such element 
considers necessary to carry out this subsection— 
‘‘(A) grant a security clearance on a tem-
porary or permanent basis to an employee or of-
ficer of a certified entity; 
‘‘(B) grant a security clearance on a tem-
porary or permanent basis to a certified entity 
and approval to use appropriate facilities; and 
‘‘(C) expedite the security clearance process 
for a person or entity as the head of such element 
considers necessary, consistent with the need to 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
protect the national security of the United 
States. 
‘‘(4) NO RIGHT OR BENEFIT.—The provision of 
information to a private-sector entity or a utility 
under this subsection shall not create a right or ben-
efit to similar information by such entity or such 
utility or any other private-sector entity or utility. 
‘‘(5) RESTRICTION
ON
DISCLOSURE
OF
CYBER 
THREAT INTELLIGENCE.—Notwithstanding any other 
provision of law, a certified entity receiving cyber 
threat intelligence pursuant to this subsection shall 
not further disclose such cyber threat intelligence to 
another entity, other than to a certified entity or 
other appropriate agency or department of the Fed-
eral Government authorized to receive such cyber 
threat intelligence. 
‘‘(b) USE OF CYBERSECURITY SYSTEMS AND SHARING 
OF CYBER THREAT INFORMATION.— 
‘‘(1) IN GENERAL.— 
‘‘(A) 
CYBERSECURITY
PROVIDERS.—Not-
withstanding any other provision of law, a cy-
bersecurity provider, with the express consent of 
a protected entity for which such cybersecurity 
provider is providing goods or services for cyber-
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
security purposes, may, for cybersecurity pur-
poses— 
‘‘(i) use cybersecurity systems to iden-
tify and obtain cyber threat information to 
protect the rights and property of such pro-
tected entity; and 
‘‘(ii) share such cyber threat informa-
tion with any other entity designated by 
such protected entity, including, if specifi-
cally designated, the Federal Government. 
‘‘(B) 
SELF-PROTECTED
ENTITIES.—Not-
withstanding any other provision of law, a self- 
protected entity may, for cybersecurity pur-
poses— 
‘‘(i) use cybersecurity systems to iden-
tify and obtain cyber threat information to 
protect the rights and property of such self- 
protected entity; and 
‘‘(ii) share such cyber threat informa-
tion with any other entity, including the 
Federal Government. 
‘‘(2) SHARING
WITH
THE
FEDERAL
GOVERN-
MENT.— 
‘‘(A) INFORMATION SHARED WITH THE NA-
TIONAL
CYBERSECURITY
AND
COMMUNICATIONS 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
INTEGRATION CENTER OF THE DEPARTMENT OF 
HOMELAND SECURITY.—Subject to the use and 
protection of information requirements under 
paragraph (3), the head of a department or 
agency of the Federal Government receiving 
cyber threat information in accordance with 
paragraph (1) shall provide such cyber threat in-
formation in as close to real time as possible to 
the National Cybersecurity and Communications 
Integration Center of the Department of Home-
land Security. 
‘‘(B) REQUEST TO SHARE WITH ANOTHER 
DEPARTMENT OR AGENCY OF THE FEDERAL GOV-
ERNMENT.—An entity sharing cyber threat in-
formation that is provided to the National Cy-
bersecurity and Communications Integration 
Center of the Department of Homeland Security 
under subparagraph (A) or paragraph (1) may 
request the head of such Center to, and the head 
of such Center may, provide such information in 
as close to real time as possible to another de-
partment or agency of the Federal Government. 
‘‘(3) USE AND PROTECTION OF INFORMATION.— 
Cyber threat information shared in accordance with 
paragraph (1)— 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(A) shall only be shared in accordance 
with any restrictions placed on the sharing of 
such information by the protected entity or self- 
protected entity authorizing such sharing, in-
cluding appropriate anonymization or mini-
mization of such information and excluding lim-
iting a department or agency of the Federal Gov-
ernment from sharing such information with an-
other department or agency of the Federal Gov-
ernment in accordance with this section; 
‘‘(B) may not be used by an entity to gain 
an unfair competitive advantage to the det-
riment of the protected entity or the self-pro-
tected entity authorizing the sharing of informa-
tion; 
‘‘(C) may only be used by a non-Federal re-
cipient of such information for a cybersecurity 
purpose; 
‘‘(D) if shared with the Federal Govern-
ment— 
‘‘(i) shall be exempt from disclosure 
under section 552 of title 5, United States 
Code (commonly known as the ‘Freedom of 
Information Act’); 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(ii) shall be considered proprietary 
information and shall not be disclosed to an 
entity outside of the Federal Government ex-
cept as authorized by the entity sharing 
such information; 
‘‘(iii) shall not be used by the Federal 
Government for regulatory purposes; 
‘‘(iv) shall not be provided by the de-
partment or agency of the Federal Govern-
ment receiving such cyber threat informa-
tion to another department or agency of the 
Federal 
Government 
under 
paragraph 
(2)(A) if— 
‘‘(I) the entity providing such in-
formation determines that the provi-
sion of such information will under-
mine the purpose for which such infor-
mation is shared; or 
‘‘(II) unless otherwise directed by 
the President, the head of the depart-
ment or agency of the Federal Govern-
ment receiving such cyber threat infor-
mation determines that the provision 
of such information will undermine the 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS