I 
114TH CONGRESS 
1ST SESSION H. R. 1731 
To amend the Homeland Security Act of 2002 to enhance multi-directional 
sharing of information related to cybersecurity risks and strengthen 
privacy and civil liberties protections, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 13, 2015 
Mr. MCCAUL (for himself and Mr. RATCLIFFE) introduced the following bill; 
which was referred to the Committee on Homeland Security 
A BILL 
To amend the Homeland Security Act of 2002 to enhance 
multi-directional sharing of information related to cyber-
security risks and strengthen privacy and civil liberties 
protections, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘National Cybersecurity 
Protection Advancement Act of 2015’’. 
SEC. 2. NATIONAL CYBERSECURITY AND COMMUNICA-
TIONS INTEGRATION CENTER. 
(a) DEFINITIONS.— 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
(1) IN GENERAL.—Subsection (a) of the second 
section 226 of the Homeland Security Act of 2002 
(6 U.S.C. 148; relating to the National Cybersecu-
rity and Communications Integration Center) is 
amended— 
(A) in paragraph (3), by striking ‘‘and’’ at 
the end; 
(B) in paragraph (4), by striking the pe-
riod at the end and inserting ‘‘; and’’; and 
(C) by adding at the end the following new 
paragraphs: 
‘‘(5) the term ‘cyber threat indicator’ means 
technical information that is necessary to describe or 
identify— 
‘‘(A) a method for probing, monitoring, 
maintaining, or establishing network awareness 
of an information system for the purpose of dis-
cerning technical vulnerabilities of such infor-
mation system, if such method is known or rea-
sonably suspected of being associated with a 
known or suspected cybersecurity risk, includ-
ing communications that reasonably appear to 
be transmitted for the purpose of gathering 
technical information related to a cybersecurity 
risk; 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(B) a method for defeating a technical or 
security control of an information system; 
‘‘(C) a technical vulnerability, including 
anomalous technical behavior that may become 
a vulnerability; 
‘‘(D) a method of causing a user with le-
gitimate access to an information system or in-
formation that is stored on, processed by, or 
transiting an information system to inadvert-
ently enable the defeat of a technical or oper-
ational control; 
‘‘(E) a method for unauthorized remote 
identification of, access to, or use of an infor-
mation system or information that is stored on, 
processed by, or transiting an information sys-
tem that is known or reasonably suspected of 
being associated with a known or suspected cy-
bersecurity risk; 
‘‘(F) the actual or potential harm caused 
by a cybersecurity risk, including a description 
of the information exfiltrated as a result of a 
particular cybersecurity risk; 
‘‘(G) any other attribute of a cybersecurity 
risk that cannot be used to identify specific per-
sons reasonably believed to be unrelated to such 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
cybersecurity risk, if disclosure of such at-
tribute is not otherwise prohibited by law; or 
‘‘(H) any combination of subparagraphs 
(A) through (G); 
‘‘(6) the term ‘cybersecurity purpose’ means the 
purpose of protecting an information system or in-
formation that is stored on, processed by, or 
transiting an information system from a cybersecu-
rity risk or incident; 
‘‘(7)(A) except as provided in subparagraph 
(B), the term ‘defensive measure’ means an action, 
device, procedure, signature, technique, or other 
measure applied to an information system or infor-
mation that is stored on, processed by, or transiting 
an information system that detects, prevents, or 
mitigates a known or suspected cybersecurity risk or 
incident, or any attribute of hardware, software, 
process, or procedure that could enable or facilitate 
the defeat of a security control; 
‘‘(B) such term does not include a measure that 
destroys, renders unusable, or substantially harms 
an information system or data on an information 
system not belonging to— 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(i) the non-Federal entity, not including a 
State, local, or tribal government, operating 
such measure; or 
‘‘(ii) another Federal entity or non-Federal 
entity that is authorized to provide consent and 
has provided such consent to the non-Federal 
entity referred to in clause (i); 
‘‘(8) the term ‘network awareness’ means to 
scan, identify, acquire, monitor, log, or analyze in-
formation that is stored on, processed by, or 
transiting an information system; 
‘‘(9)(A) the term ‘private entity’ means a non- 
Federal entity that is an individual or private group, 
organization, proprietorship, partnership, trust, co-
operative, corporation, or other commercial or non- 
profit entity, including an officer, employee, or agent 
thereof; 
‘‘(B) such term includes a component of a 
State, local, or tribal government performing electric 
utility services; 
‘‘(10) the term ‘security control’ means the 
management, operational, and technical controls 
used to protect against an unauthorized effort to ad-
versely affect the confidentially, integrity, or avail-
ability of an information system or information that 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
is stored on, processed by, or transiting an informa-
tion system; and 
‘‘(11) the term ‘sharing’ means providing, re-
ceiving, and disseminating.’’. 
(b) AMENDMENT.—Subparagraph (B) of subsection 
(d)(1) of such second section 226 of the Homeland Secu-
rity Act of 2002 is amended— 
(1) in clause (i), by striking ‘‘and local’’ and in-
serting ‘‘, local, and tribal’’; 
(2) in clause (ii)— 
(A) by inserting ‘‘, including information 
sharing and analysis centers’’ before the semi-
colon; and 
(B) by striking ‘‘and’’ at the end; 
(3) in clause (iii), by striking the period at the 
end and inserting ‘‘; and’’; and 
(4) by adding at the end the following new 
clause: 
‘‘(iv) private entities.’’. 
SEC. 3. INFORMATION SHARING STRUCTURE AND PROC-
ESSES. 
The second section 226 of the Homeland Security Act 
of 2002 (6 U.S.C. 148; relating to the National Cyberse-
curity and Communications Integration Center) is amend-
ed— 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
(1) in subsection (c)— 
(A) in paragraph (1)— 
(i) by striking ‘‘a Federal civilian 
interface’’ and inserting ‘‘the lead Federal 
civilian interface’’; and 
(ii) by striking ‘‘cybersecurity risks,’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; 
(B) in paragraph (3), by striking ‘‘cyberse-
curity risks’’ and inserting ‘‘cyber threat indica-
tors, defensive measures, cybersecurity risks,’’; 
(C) in paragraph (5)(A), by striking ‘‘cy-
bersecurity risks’’ and inserting ‘‘cyber threat 
indicators, defensive measures, cybersecurity 
risks,’’; 
(D) in paragraph (6)— 
(i) by striking ‘‘cybersecurity risks’’ 
and inserting ‘‘cyber threat indicators, de-
fensive measures, cybersecurity risks,’’; 
and 
(ii) by striking ‘‘and’’ at the end; 
(E) in paragraph (7)— 
(i) in subparagraph (A), by striking 
‘‘and’’ at the end; 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
any significant violations of the policies and proce-
dures specified in subsection (i)(6)(A); and 
‘‘(11) promptly notifying non-Federal entities 
that have shared cyber threat indicators or defensive 
measures that are known or determined to be in 
error or in contravention of the requirements of this 
section.’’; 
(2) in subsection (d)— 
(A) in subparagraph (D), by striking 
‘‘and’’ at the end; 
(B) by redesignating subparagraph (E) as 
subparagraph (I); and 
(C) by inserting after subparagraph (D) 
the following new subparagraphs: 
‘‘(E) an entity that collaborates with State 
and local governments on cybersecurity risks 
and incidents, and has entered into a voluntary 
information sharing relationship with the Cen-
ter; 
‘‘(F) a United States Computer Emer-
gency Readiness Team that coordinates infor-
mation related to cybersecurity risks and inci-
dents, proactively and collaboratively addresses 
cybersecurity risks and incidents to the United 
States, collaboratively responds to cybersecurity 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
risks and incidents, provides technical assist-
ance, upon request, to information system own-
ers and operators, and shares cyber threat indi-
cators, defensive measures, or information re-
lated to cybersecurity risks and incidents in a 
timely manner; 
‘‘(G) the Industrial Control System Cyber 
Emergency Response Team that— 
‘‘(i) coordinates with industrial con-
trol systems owners and operators; 
‘‘(ii) provides training, upon request, 
to Federal entities and non-Federal enti-
ties on industrial control systems cyberse-
curity; 
‘‘(iii) collaboratively addresses cyber-
security risks and incidents to industrial 
control systems; 
‘‘(iv) provides technical assistance, 
upon request, to Federal entities and non- 
Federal entities relating to industrial con-
trol systems cybersecurity; and 
‘‘(v) shares cyber threat indicators, 
defensive measures, or information related 
to cybersecurity risks and incidents of in-
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
dustrial control systems in a timely fash-
ion; 
‘‘(H) a National Coordinating Center for 
Communications that coordinates the protec-
tion, response, and recovery of emergency com-
munications; and’’; 
(3) in subsection (e)— 
(A) in paragraph (1)— 
(i) in subparagraph (A), by inserting 
‘‘cyber threat indicators, defensive meas-
ures, and’’ before ‘‘information’’; 
(ii) in subparagraph (B), by inserting 
‘‘cyber threat indicators, defensive meas-
ures, and’’ before ‘‘information’’; 
(iii) in subparagraph (F), by striking 
‘‘cybersecurity risks’’ and inserting ‘‘cyber 
threat indicators, defensive measures, cy-
bersecurity risks,’’; and 
(iv) in subparagraph (G), by striking 
‘‘cybersecurity risks’’ and inserting ‘‘cyber 
threat indicators, defensive measures, cy-
bersecurity risks,’’; 
(B) in paragraph (2)— 
(i) by striking ‘‘cybersecurity risks’’ 
and inserting ‘‘cyber threat indicators, de-
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
fensive measures, cybersecurity risks,’’; 
and 
(ii) by inserting ‘‘or disclosure’’ before 
the semicolon at the end; and 
(C) in paragraph (3), by inserting before 
the period at the end the following: ‘‘, including 
by working with the Chief Privacy Officer ap-
pointed under section 222 to ensure that the 
Center follows the policies and procedures speci-
fied in subsection (i)(6)(A)’’; and 
(4) by adding at the end the following new sub-
sections: 
‘‘(g) RAPID AUTOMATED SHARING.— 
‘‘(1) IN GENERAL.—The Under Secretary for 
Cybersecurity and Infrastructure Protection, in co-
ordination with industry and other stakeholders, 
shall develop capabilities based on standards and 
widely used approaches in the information tech-
nology industry that support and rapidly advance 
the development, adoption, and implementation of 
automated mechanisms for the timely sharing of 
cyber threat indicators and defensive measures to 
and from the Center and with each Federal agency 
designated as the ‘Sector Specific Agency’ for each 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
critical infrastructure sector in accordance with sub-
section (h). 
‘‘(2) BIANNUAL
REPORT.—The Under Sec-
retary for Cybersecurity and Infrastructure Protec-
tion shall submit to the Committee on Homeland Se-
curity of the House of Representatives and the Com-
mittee on Homeland Security and Governmental Af-
fairs of the Senate a biannual report on the status 
and progress of the development of the capability de-
scribed in paragraph (1). Such reports shall be re-
quired until such capability is fully implemented. 
‘‘(h) SECTOR SPECIFIC AGENCIES.—The Secretary, 
in collaboration with the relevant critical infrastructure 
sector and the heads of other appropriate Federal agen-
cies, shall recognize the Federal agency designated as of 
March 25, 2015, as the ‘Sector Specific Agency’ for each 
critical infrastructure sector designated in the Depart-
ment’s National Infrastructure Protection Plan. If the 
designated Sector Specific Agency for a particular critical 
infrastructure sector is the Department, for purposes of 
this section, the Secretary is deemed to be the head of 
such Sector Specific Agency and shall carry out this sec-
tion. The Secretary, in coordination with the heads of each 
such Sector Specific Agency, shall— 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(1) support the security and resilience actives 
of the relevant critical infrastructure sector in ac-
cordance with this section; 
‘‘(2) provide institutional knowledge, specialized 
expertise, and technical assistance upon request to 
the relevant critical infrastructure sector; and 
‘‘(3) support the timely sharing of cyber threat 
indicators and defensive measures with the relevant 
critical infrastructure sector with the Center in ac-
cordance with this section. 
‘‘(i) VOLUNTARY INFORMATION SHARING PROCE-
DURES.— 
‘‘(1) PROCEDURES.— 
‘‘(A) IN GENERAL.—The Center may enter 
into a voluntary information sharing relation-
ship with any consenting non-Federal entity for 
the sharing of cyber threat indicators and de-
fensive measures for cybersecurity purposes in 
accordance with this section. Nothing in this 
section may be construed to require any non- 
Federal entity to enter into any such informa-
tion sharing relationship with the Center or any 
other entity. The Center may terminate a vol-
untary information sharing relationship under 
this subsection if the Center determines that 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
the non-Federal entity with which the Center 
has entered into such a relationship has, after 
repeated notice, repeatedly and intentionally 
violated the terms of this subsection. 
‘‘(B) NATIONAL
SECURITY.—The Sec-
retary may decline to enter into a voluntary in-
formation sharing relationship under this sub-
section if the Secretary determines that such is 
appropriate for national security. 
‘‘(2) VOLUNTARY INFORMATION SHARING RELA-
TIONSHIPS.—A voluntary information sharing rela-
tionship under this subsection may be characterized 
as an agreement described in this paragraph. 
‘‘(A) STANDARD
AGREEMENT.—For the 
use of a non-Federal entity, the Center shall 
make available a standard agreement, con-
sistent with this section, on the Department’s 
website. 
‘‘(B) NEGOTIATED
AGREEMENT.—At the 
request of a non-Federal entity, and if deter-
mined appropriate by the Center, the Depart-
ment shall negotiate a non-standard agreement, 
consistent with this section. 
‘‘(C) EXISTING AGREEMENTS.—An agree-
ment between the Center and a non-Federal en-
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
tity that is entered into before the date of the 
enactment of this section, or such an agreement 
that is in effect before such date, shall be 
deemed in compliance with the requirements of 
this subsection, notwithstanding any other pro-
vision or requirement of this subsection. An 
agreement under this subsection shall include 
the relevant privacy protections as in effect 
under the Cooperative Research and Develop-
ment Agreement for Cybersecurity Information 
Sharing and Collaboration, as of December 31, 
2014. Nothing in this subsection may be con-
strued to require a non-Federal entity to enter 
into either a standard or negotiated agreement 
to be in compliance with this subsection. 
‘‘(3) 
INFORMATION
SHARING
AUTHORIZA-
TION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B), and notwithstanding any 
other provision of law, a non-Federal entity 
may, for cybersecurity purposes, share cyber 
threat indicators or defensive measures ob-
tained on its own information system, or on an 
information system of another Federal entity or 
non-Federal entity, upon written consent of 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
such other Federal entity or non-Federal entity 
or an authorized representative of such other 
Federal entity or non-Federal entity in accord-
ance with this section with— 
‘‘(i) another non-Federal entity; or 
‘‘(ii) the Center, as provided in this 
section. 
‘‘(B) LAWFUL RESTRICTION.—A non-Fed-
eral entity receiving a cyber threat indicator or 
defensive measure from another Federal entity 
or non-Federal entity shall comply with other-
wise lawful restrictions placed on the sharing or 
use of such cyber threat indicator or defensive 
measure by the sharing Federal entity or non- 
Federal entity. 
‘‘(C) REMOVAL
OF
INFORMATION
UNRE-
LATED
TO
CYBERSECURITY
RISKS
OR
INCI-
DENTS.—Federal entities and non-Federal enti-
ties shall, prior to such sharing, take reasonable 
efforts to remove information that can be used 
to identify specific persons and is reasonably 
believed at the time of sharing to be unrelated 
to a cybersecurity risks or incident and to safe-
guard information that can be used to identify 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
specific persons from unintended disclosure or 
unauthorized access or acquisition. 
‘‘(D) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) limit or modify an existing infor-
mation sharing relationship; 
‘‘(ii) prohibit a new information shar-
ing relationship; 
‘‘(iii) require a new information shar-
ing relationship between any non-Federal 
entity and a Federal entity; 
‘‘(iv) limit otherwise lawful activity; or 
‘‘(v) in any manner impact or modify 
procedures in existence as of the date of 
the enactment of this section for reporting 
known or suspected criminal activity to ap-
propriate law enforcement authorities or 
for participating voluntarily or under legal 
requirement in an investigation. 
‘‘(4) NETWORK AWARENESS AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government, 
may, for cybersecurity purposes, conduct net-
work awareness of— 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity, upon written consent 
of such other non-Federal entity for con-
ducting such network awareness to protect 
the rights or property of such other non- 
Federal entity; 
‘‘(iii) an information system of a Fed-
eral entity, upon written consent of an au-
thorized representative of such Federal en-
tity for conducting such network awareness 
to protect the rights or property of such 
Federal entity; or 
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) authorize conducting network 
awareness of an information system, or the 
use of any information obtained through 
such conducting of network awareness, 
other than as provided in this section; or 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(ii) limit otherwise lawful activity. 
‘‘(5) DEFENSIVE MEASURE AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B) and notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government, 
may, for cybersecurity purposes, operate a de-
fensive measure that is applied to— 
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity upon written consent of 
such other non-Federal entity for operation 
of such defensive measure to protect the 
rights or property of such other non-Fed-
eral entity; 
‘‘(iii) an information system of a Fed-
eral entity upon written consent of an au-
thorized representative of such Federal en-
tity for operation of such defensive meas-
ure to protect the rights or property of 
such Federal entity; or 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) authorize the use of a defensive 
measure other than as provided in this sec-
tion; or 
‘‘(ii) limit otherwise lawful activity. 
‘‘(6) PRIVACY AND CIVIL LIBERTIES PROTEC-
TIONS.— 
‘‘(A) POLICIES AND PROCEDURES.— 
‘‘(i) IN GENERAL.—The Under Sec-
retary for Cybersecurity and Infrastructure 
Protection shall, in coordination with the 
Chief Privacy Officer and the Chief Civil 
Rights and Civil Liberties Officer of the 
Department, establish and annually review 
policies and procedures governing the re-
ceipt, retention, use, and disclosure of 
cyber threat indicators, defensive meas-
ures, and information related to cybersecu-
rity risks and incidents shared with the 
Center in accordance with this section. 
Such policies and procedures shall apply 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
only to the Department, consistent with 
the need to protect information systems 
from cybersecurity risks and incidents and 
mitigate cybersecurity risks and incidents 
in a timely manner, and shall— 
‘‘(I) be consistent with the De-
partment’s Fair Information Practice 
Principles developed pursuant to sec-
tion 552a of title 5, United States 
Code (commonly referred to as the 
‘Privacy Act of 1974’ or the ‘Privacy 
Act’), and subject to the Secretary’s 
authority under subsection (a)(2) of 
section 222 of this Act; 
‘‘(II) reasonably limit, to the 
greatest extent practicable, the re-
ceipt, retention, use, and disclosure of 
cyber threat indicators and defensive 
measures associated with specific per-
sons that is not necessary, for cyber-
security purposes, to protect a net-
work or information system from cy-
bersecurity risks or mitigate cyberse-
curity risks and incidents in a timely 
manner; 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(III) minimize any impact on 
privacy and civil liberties; 
‘‘(IV) 
provide 
data 
integrity 
through the prompt removal and de-
struction of obsolete or erroneous 
names and personal information that 
is unrelated to the cybersecurity risk 
or incident information shared and re-
tained by the Center in accordance 
with this section; 
‘‘(V) include requirements to 
safeguard cyber threat indicators and 
defensive measures retained by the 
Center, including information that is 
proprietary or business-sensitive that 
may be used to identify specific per-
sons from unauthorized access or ac-
quisition; 
‘‘(VI) protect the confidentiality 
of cyber threat indicators and defen-
sive measures associated with specific 
persons to the greatest extent prac-
ticable; and 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(VII) ensure all relevant con-
stitutional, legal, and privacy protec-
tions are observed. 
‘‘(ii) SUBMISSION
TO
CONGRESS.— 
Not later than 180 days after the date of 
the enactment of this section and annually 
thereafter, the Chief Privacy Officer and 
the Officer for Civil Rights and Civil Lib-
erties of the Department, in consultation 
with the Privacy and Civil Liberties Over-
sight Board (established pursuant to sec-
tion 1061 of the Intelligence Reform and 
Terrorism Prevention Act of 2004 (42 
U.S.C. 2000ee)), shall submit to the Com-
mittee on Homeland Security of the House 
of Representatives and the Committee on 
Homeland Security and Governmental Af-
fairs of the Senate the policies and proce-
dures governing the sharing of cyber threat 
indicators, defensive measures, and infor-
mation related to cybsersecurity risks and 
incidents described in clause (i) of sub-
paragraph (A). 
‘‘(iii) PUBLIC NOTICE AND ACCESS.— 
The Under Secretary for Cybersecurity 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
and Infrastructure Protection, in consulta-
tion with the Chief Privacy Officer and the 
Chief Civil Rights and Civil Liberties Offi-
cer of the Department, and the Privacy 
and Civil Liberties Oversight Board (estab-
lished pursuant to section 1061 of the In-
telligence Reform and Terrorism Preven-
tion Act of 2004 (42 U.S.C. 2000ee)), 
shall ensure there is public notice of, and 
access to, the policies and procedures gov-
erning the sharing of cyber threat indica-
tors, defensive measures, and information 
related to cybersecurity risks and inci-
dents. 
‘‘(B) IMPLEMENTATION.—The Chief Pri-
vacy Officer of the Department, on an ongoing 
basis, shall— 
‘‘(i) monitor the implementation of 
the policies and procedures governing the 
sharing of cyber threat indicators and de-
fensive measures established pursuant to 
clause (i) of subparagraph (A); 
‘‘(ii) regularly review and update pri-
vacy impact assessments, as appropriate, 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
to ensure all relevant constitutional, legal, 
and privacy protections are being followed; 
‘‘(iii) work with the Under Secretary 
for Cybersecurity and Infrastructure Pro-
tection to carry out paragraphs (10) and 
(11) of subsection (c); 
‘‘(iv) annually submit to the Com-
mittee on Homeland Security of the House 
of Representatives and the Committee on 
Homeland Security and Governmental Af-
fairs of the Senate a report that contains 
a review of the effectiveness of such poli-
cies and procedures to protect privacy and 
civil liberties; and 
‘‘(v) ensure there are appropriate 
sanctions in place for officers, employees, 
or agents of the Department who inten-
tionally or willfully conduct activities under 
this section in an unauthorized manner. 
‘‘(C) INSPECTOR GENERAL REPORT.—The 
Inspector General of the Department, in con-
sultation with the Privacy and Civil Liberties 
Oversight Board and the Inspector General of 
each Federal agency that receives cyber threat 
indicators or defensive measures shared with 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
the Center under this section, shall, not later 
than two years after the date of the enactment 
of this subsection and periodically thereafter 
submit to the Committee on Homeland Security 
of the House of Representatives and the Com-
mittee on Homeland Security and Govern-
mental Affairs of the Senate a report con-
taining a review of the use of cybersecurity risk 
information shared with the Center, including 
the following: 
‘‘(i) A report on the receipt, use, and 
dissemination of cyber threat indicators 
and defensive measures that have been 
shared with Federal entities under this 
section. 
‘‘(ii) Information on the use by the 
Center of such information for a purpose 
other than a cybersecurity purpose. 
‘‘(iii) A review of the type of informa-
tion shared with the Center under this sec-
tion. 
‘‘(iv) A review of the actions taken by 
the Center based on such information. 
‘‘(v) The appropriate metrics that 
exist to determine the impact, if any, on 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
privacy and civil liberties as a result of the 
sharing of such information with the Cen-
ter. 
‘‘(vi) A list of other Federal agencies 
receiving such information. 
‘‘(vii) A review of the sharing of such 
information within the Federal Govern-
ment to identify inappropriate stove piping 
of such information. 
‘‘(viii) Any recommendations of the 
Inspector General of the Department for 
improvements or modifications to informa-
tion sharing under this section. 
‘‘(D) PRIVACY AND CIVIL LIBERTIES OFFI-
CERS REPORT.—The Chief Privacy Officer and 
the Chief Civil Rights and Civil Liberties Offi-
cer of the Department, in consultation with the 
Privacy and Civil Liberties Oversight Board, 
the Inspector General of the Department, and 
the senior privacy and civil liberties officer of 
each Federal agency that receives cyber threat 
indicators and defensive measures shared with 
the Center under this section, shall biennially 
submit to the appropriate congressional com-
mittees a report assessing the privacy and civil 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
liberties impact of the activities under this 
paragraph. Each such report shall include any 
recommendations the Chief Privacy Officer and 
the Chief Civil Rights and Civil Liberties Offi-
cer of the Department consider appropriate to 
minimize or mitigate the privacy and civil lib-
erties impact of the sharing of cyber threat in-
dicators and defensive measures under this sec-
tion. 
‘‘(E) FORM.—Each report required under 
paragraphs (C) and (D) shall be submitted in 
unclassified form, but may include a classified 
annex. 
‘‘(7) USES
AND
PROTECTION
OF
INFORMA-
TION.— 
‘‘(A) NON-FEDERAL
ENTITIES.—A non- 
Federal entity, not including a State, local, or 
tribal government, that shares cyber threat in-
dicators or defensive measures through the Cen-
ter or otherwise under this section— 
‘‘(i) may use, retain, or further dis-
close such cyber threat indicators or defen-
sive measures solely for cybersecurity pur-
poses; 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(ii) shall, prior to such sharing, take 
reasonable efforts to remove information 
that can be used to identify specific per-
sons and is reasonably believed at the time 
of sharing to be unrelated to a cybersecu-
rity risk or incident, and to safeguard in-
formation that can be used to identify spe-
cific persons from unintended disclosure or 
unauthorized access or acquisition; 
‘‘(iii) shall comply with appropriate 
restrictions that a Federal entity or non- 
Federal entity places on the subsequent 
disclosure or retention of cyber threat indi-
cators and defensive measures that it dis-
closes to other Federal entities or non-Fed-
eral entities; 
‘‘(iv) shall be deemed to have volun-
tarily shared such cyber threat indicators 
or defensive measures; 
‘‘(v) shall implement and utilize a se-
curity control to protect against unauthor-
ized access to or acquisition of such cyber 
threat indicators or defensive measures; 
and 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(vi) may not use such information to 
gain an unfair competitive advantage to 
the detriment of any non-Federal entity. 
‘‘(B) FEDERAL ENTITIES.— 
‘‘(i) USES OF INFORMATION.—A Fed-
eral entity that receives cyber threat indi-
cators 
or 
defensive 
measures 
shared 
through the Center or otherwise under this 
section from another Federal entity or a 
non-Federal entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators 
or defensive measures solely for cyber-
security purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove in-
formation that can be used to identify 
specific persons and is reasonably be-
lieved at the time of sharing to be un-
related to a cybersecurity risk or inci-
dent, and to safeguard information 
that can be used to identify specific 
persons from unintended disclosure or 
unauthorized access or acquisition; 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(III) shall be deemed to have 
voluntarily shared such cyber threat 
indicators or defensive measures; and 
‘‘(IV) shall implement and utilize 
a security control to protect against 
unauthorized access to or acquisition 
of such cyber threat indicators or de-
fensive measures. 
‘‘(ii) PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
‘‘(I) are exempt from disclosure 
under section 552 of title 5, United 
States Code, and withheld, without 
discretion, from the public under sub-
section (b)(3)(B) of such section; 
‘‘(II) may not be used by the 
Federal Government for regulatory 
purposes; 
‘‘(III) may not constitute a waiv-
er of any applicable privilege or pro-
tection provided by law, including 
trade secret protection; 
‘‘(IV) shall be considered the 
commercial, financial, and proprietary 
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS
information of the non-Federal entity 
referred to in clause (i) when so des-
ignated by such non-Federal entity; 
and 
‘‘(V) may not be subject to a rule 
of any Federal entity or any judicial 
doctrine regarding ex parte commu-
nications with a decisionmaking offi-
cial. 
‘‘(C) STATE, LOCAL, OR TRIBAL GOVERN-
MENT.— 
‘‘(i) 
USES
OF
INFORMATION.—A 
State, local, or tribal government that re-
ceives cyber threat indicators or defensive 
measures from the Center from a Federal 
entity or a non-Federal entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators 
or defensive measures solely for cyber-
security purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove in-
formation that can be used to identify 
specific persons and is reasonably be-
lieved at the time of sharing to be un-
VerDate Sep 11 2014 
03:33 Apr 14, 2015
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H1731.IH
H1731
SSpencer on DSK4SPTVN1PROD with BILLS