I 
112TH CONGRESS 
1ST SESSION H. R. 3523 
To provide for the sharing of certain cyber threat intelligence and cyber 
threat information between the intelligence community and cybersecurity 
entities, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 30, 2011 
Mr. ROGERS of Michigan (for himself, Mr. RUPPERSBERGER, Mr. KING of 
New York, Mr. UPTON, Mrs. MYRICK, Mr. LANGEVIN, Mr. CONAWAY, 
Mr. MILLER of Florida, Mr. BOREN, Mr. LOBIONDO, Mr. CHANDLER, 
Mr. NUNES, Mr. GUTIERREZ, Mr. WESTMORELAND, Mrs. BACHMANN, 
Mr. ROONEY, Mr. HECK, Mr. DICKS, Mr. MCCAUL, Mr. WALDEN, Mr. 
CALVERT, Mr. SHIMKUS, Mr. TERRY, Mr. BURGESS, Mr. GINGREY of 
Georgia, Mr. THOMPSON of California, Mr. KINZINGER of Illinois, Mr. 
AMODEI, and Mr. POMPEO) introduced the following bill; which was re-
ferred to the Select Committee on Intelligence (Permanent Select) 
A BILL 
To provide for the sharing of certain cyber threat intelligence 
and cyber threat information between the intelligence 
community and cybersecurity entities, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber Intelligence 
Sharing and Protection Act of 2011’’. 
VerDate Mar 15 2010 
23:17 Nov 30, 2011
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3523.IH
H3523
emcdonald on DSK5VPTVN1PROD with BILLS
SEC. 2. CYBER THREAT INTELLIGENCE AND INFORMATION 
SHARING. 
(a) IN GENERAL.—Title XI of the National Security 
Act of 1947 (50 U.S.C. 442 et seq.) is amended by adding 
at the end the following new section: 
‘‘CYBER THREAT INTELLIGENCE AND INFORMATION 
SHARING 
‘‘SEC. 1104. (a) INTELLIGENCE COMMUNITY SHAR-
ING OF CYBER THREAT INTELLIGENCE WITH PRIVATE 
SECTOR.— 
‘‘(1) IN GENERAL.—The Director of National 
Intelligence shall establish procedures to allow ele-
ments of the intelligence community to share cyber 
threat intelligence with private-sector entities and to 
encourage the sharing of such intelligence. 
‘‘(2) SHARING AND USE OF CLASSIFIED INTEL-
LIGENCE.—The procedures established under para-
graph (1) shall provide that classified cyber threat 
intelligence may only be— 
‘‘(A) shared by an element of the intel-
ligence community with— 
‘‘(i) certified entities; or 
‘‘(ii) a person with an appropriate se-
curity clearance to receive such cyber 
threat intelligence; 
VerDate Mar 15 2010 
23:17 Nov 30, 2011
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3523.IH
H3523
emcdonald on DSK5VPTVN1PROD with BILLS
‘‘(B) shared consistent with the need to 
protect the national security of the United 
States; and 
‘‘(C) used by a certified entity in a manner 
which protects such cyber threat intelligence 
from unauthorized disclosure. 
‘‘(3) SECURITY CLEARANCE APPROVALS.—The 
Director of National Intelligence shall issue guide-
lines providing that the head of an element of the 
intelligence community may, as the head of such ele-
ment considers necessary to carry out this sub-
section— 
‘‘(A) grant a security clearance on a tem-
porary or permanent basis to an employee or 
officer of a certified entity; 
‘‘(B) grant a security clearance on a tem-
porary or permanent basis to a certified entity 
and approval to use appropriate facilities; and 
‘‘(C) expedite the security clearance proc-
ess for a person or entity as the head of such 
element considers necessary, consistent with the 
need to protect the national security of the 
United States. 
‘‘(4) NO RIGHT OR BENEFIT.—The provision of 
information to a private-sector entity under this sub-
VerDate Mar 15 2010 
23:17 Nov 30, 2011
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3523.IH
H3523
emcdonald on DSK5VPTVN1PROD with BILLS
section shall not create a right or benefit to similar 
information by such entity or any other private-sec-
tor entity. 
‘‘(b) PRIVATE SECTOR USE OF CYBERSECURITY SYS-
TEMS AND SHARING OF CYBER THREAT INFORMATION.— 
‘‘(1) IN GENERAL.— 
‘‘(A) CYBERSECURITY
PROVIDERS.—Not-
withstanding any other provision of law, a cy-
bersecurity provider, with the express consent 
of a protected entity for which such cybersecu-
rity provider is providing goods or services for 
cybersecurity purposes, may, for cybersecurity 
purposes— 
‘‘(i) use cybersecurity systems to iden-
tify and obtain cyber threat information to 
protect the rights and property of such 
protected entity; and 
‘‘(ii) share such cyber threat informa-
tion with any other entity designated by 
such protected entity, including, if specifi-
cally designated, the Federal Government. 
‘‘(B) SELF-PROTECTED
ENTITIES.—Not-
withstanding any other provision of law, a self- 
protected entity may, for cybersecurity pur-
poses— 
VerDate Mar 15 2010 
23:17 Nov 30, 2011
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3523.IH
H3523
emcdonald on DSK5VPTVN1PROD with BILLS
mission of information under this subsection to the 
Federal Government shall not satisfy or affect any 
requirement under any other provision of law for a 
person or entity to provide information to the Fed-
eral Government. 
‘‘(c) REPORT ON INFORMATION SHARING.—The Pri-
vacy and Civil Liberties Oversight Board established 
under section 1061 of the Intelligence Reform and Ter-
rorism Prevention Act of 2004 (5 U.S.C. 601 note) shall 
annually submit to Congress a report in unclassified form 
containing— 
‘‘(1) a review of the sharing and use of infor-
mation by the Federal Government under this sec-
tion and the procedures and guidelines established 
or issued by the Director of National Intelligence 
under subsection (a); and 
‘‘(2) any recommendations of the Board for im-
provements or modifications to such authorities to 
address privacy and civil liberties concerns. 
‘‘(d) FEDERAL PREEMPTION.—This section super-
sedes any statute of a State or political subdivision of a 
State that restricts or otherwise expressly regulates an ac-
tivity authorized under subsection (b). 
‘‘(e) SAVINGS CLAUSE.—Nothing in this section shall 
be construed to limit any other authority to use a cyberse-
VerDate Mar 15 2010 
23:17 Nov 30, 2011
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3523.IH
H3523
emcdonald on DSK5VPTVN1PROD with BILLS
curity system or to identify, obtain, or share cyber threat 
intelligence or cyber threat information. 
‘‘(f) DEFINITIONS.—In this section: 
‘‘(1) CERTIFIED ENTITY.—The term ‘certified 
entity’ means a protected entity, self-protected enti-
ty, or cybersecurity provider that— 
‘‘(A) possesses or is eligible to obtain a se-
curity clearance, as determined by the Director 
of National Intelligence; and 
‘‘(B) is able to demonstrate to the Director 
of National Intelligence that such provider or 
such entity can appropriately protect classified 
cyber threat intelligence. 
‘‘(2) CYBER
THREAT
INTELLIGENCE.—The 
term ‘cyber threat intelligence’ means information in 
the possession of an element of the intelligence com-
munity directly pertaining to a vulnerability of, or 
threat to, a system or network of a government or 
private entity, including information pertaining to 
the protection of a system or network from— 
‘‘(A) efforts to degrade, disrupt, or destroy 
such system or network; or 
‘‘(B) theft or misappropriation of private 
or government information, intellectual prop-
erty, or personally identifiable information. 
VerDate Mar 15 2010 
23:17 Nov 30, 2011
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3523.IH
H3523
emcdonald on DSK5VPTVN1PROD with BILLS
‘‘(3) CYBERSECURITY
PROVIDER.—The term 
‘cybersecurity provider’ means a non-governmental 
entity that provides goods or services intended to be 
used for cybersecurity purposes. 
‘‘(4) CYBERSECURITY PURPOSE.—The term ‘cy-
bersecurity purpose’ means the purpose of ensuring 
the integrity, confidentiality, or availability of, or 
safeguarding, a system or network, including pro-
tecting a system or network from— 
‘‘(A) efforts to degrade, disrupt, or destroy 
such system or network; or 
‘‘(B) theft or misappropriation of private 
or government information, intellectual prop-
erty, or personally identifiable information. 
‘‘(5) CYBERSECURITY SYSTEM.—The term ‘cy-
bersecurity system’ means a system designed or em-
ployed to ensure the integrity, confidentiality, or 
availability of, or safeguard, a system or network, 
including protecting a system or network from— 
‘‘(A) efforts to degrade, disrupt, or destroy 
such system or network; or 
‘‘(B) theft or misappropriation of private 
or government information, intellectual prop-
erty, or personally identifiable information. 
VerDate Mar 15 2010 
23:17 Nov 30, 2011
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3523.IH
H3523
emcdonald on DSK5VPTVN1PROD with BILLS
‘‘(6) CYBER THREAT INFORMATION.—The term 
‘cyber threat information’ means information di-
rectly pertaining to a vulnerability of, or threat to a 
system or network of a government or private entity, 
including information pertaining to the protection of 
a system or network from— 
‘‘(A) efforts to degrade, disrupt, or destroy 
such system or network; or 
‘‘(B) theft or misappropriation of private 
or government information, intellectual prop-
erty, or personally identifiable information. 
‘‘(7) PROTECTED ENTITY.—The term ‘protected 
entity’ means an entity, other than an individual, 
that contracts with a cybersecurity provider for 
goods or services to be used for cybersecurity pur-
poses. 
‘‘(8) SELF-PROTECTED
ENTITY.—The term 
‘self-protected entity’ means an entity, other than an 
individual, that provides goods or services for cyber-
security purposes to itself.’’. 
(b) PROCEDURES AND GUIDELINES.—The Director 
of National Intelligence shall— 
(1) not later than 60 days after the date of the 
enactment of this Act, establish procedures under 
paragraph (1) of section 1104(a) of the National Se-
VerDate Mar 15 2010 
23:17 Nov 30, 2011
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3523.IH
H3523
emcdonald on DSK5VPTVN1PROD with BILLS
curity Act of 1947, as added by subsection (a) of 
this section, and issue guidelines under paragraph 
(3) of such section 1104(a); and 
(2) following the establishment of such proce-
dures and the issuance of such guidelines, expedi-
tiously distribute such procedures and such guide-
lines to appropriate Federal Government and pri-
vate-sector entities. 
(c) INITIAL REPORT.—The first report required to be 
submitted under subsection (c) of section 1104 of the Na-
tional Security Act of 1947, as added by subsection (a) 
of this section, shall be submitted not later than one year 
after the date of the enactment of this Act. 
(d) TABLE OF CONTENTS AMENDMENT.—The table 
of contents in the first section of such Act is amended 
by adding at the end the following new item: 
‘‘Sec. 1104. Cyber threat intelligence and information sharing.’’. 
Æ 
VerDate Mar 15 2010 
23:17 Nov 30, 2011
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6301
E:\BILLS\H3523.IH
H3523
emcdonald on DSK5VPTVN1PROD with BILLS