information that may be used to identify 
specific persons from unauthorized access or 
acquisition; 
‘‘(iv) protect the confidentiality of 
cyber threat information associated with 
specific persons to the greatest extent prac-
ticable; and 
‘‘(v) not delay or impede the flow of 
cyber threat information necessary to defend 
against or mitigate a cyber threat. 
‘‘(B) SUBMISSION TO CONGRESS.—The Di-
rector of National Intelligence shall, consistent 
with the need to protect sources and methods, 
submit to Congress the policies and procedures 
required under subparagraph (A) and any up-
dates to such policies and procedures. 
‘‘(C) IMPLEMENTATION.—The head of each 
department or agency of the Federal Government 
receiving cyber threat information shared with 
the Federal Government under subsection (b)(1) 
shall— 
‘‘(i) implement the policies and proce-
dures established under subparagraph (A); 
and 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(ii) promptly notify the Director of 
National Intelligence, the Attorney General, 
and the congressional intelligence commit-
tees of any significant violations of such 
policies and procedures. 
‘‘(D) OVERSIGHT.—The Director of Na-
tional Intelligence, in consultation with the At-
torney General, the Secretary of Homeland Secu-
rity, and the Secretary of Defense, shall establish 
a program to monitor and oversee compliance 
with the policies and procedures established 
under subparagraph (A). 
‘‘(d) FEDERAL GOVERNMENT LIABILITY FOR VIOLA-
TIONS OF RESTRICTIONS ON THE DISCLOSURE, USE, AND 
PROTECTION OF VOLUNTARILY SHARED INFORMATION.— 
‘‘(1) IN GENERAL.—If a department or agency of 
the Federal Government intentionally or willfully vio-
lates subsection (b)(3)(D) or subsection (c) with re-
spect to the disclosure, use, or protection of volun-
tarily shared cyber threat information shared under 
this section, the United States shall be liable to a per-
son adversely affected by such violation in an amount 
equal to the sum of— 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(A) the actual damages sustained by the 
person as a result of the violation or $1,000, 
whichever is greater; and 
‘‘(B) the costs of the action together with 
reasonable attorney fees as determined by the 
court. 
‘‘(2) VENUE.—An action to enforce liability cre-
ated under this subsection may be brought in the dis-
trict court of the United States in— 
‘‘(A) the district in which the complainant 
resides; 
‘‘(B) the district in which the principal 
place of business of the complainant is located; 
‘‘(C) the district in which the department or 
agency of the Federal Government that disclosed 
the information is located; or 
‘‘(D) the District of Columbia. 
‘‘(3) STATUTE OF LIMITATIONS.—No action shall 
lie under this subsection unless such action is com-
menced not later than two years after the date of the 
violation of subsection (b)(3)(D) or subsection (c) that 
is the basis for the action. 
‘‘(4) EXCLUSIVE CAUSE OF ACTION.—A cause of 
action under this subsection shall be the exclusive 
means available to a complainant seeking a remedy 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
for a violation of subsection (b)(3)(D) or subsection 
(c). 
‘‘(e) REPORTS ON INFORMATION SHARING.— 
‘‘(1) INSPECTOR GENERAL REPORT.—The Inspec-
tor General of the Intelligence Community, in con-
sultation with the Inspector General of the Depart-
ment of Justice, the Inspector General of the Depart-
ment of Defense, and the Privacy and Civil Liberties 
Oversight Board, shall annually submit to the con-
gressional intelligence committees a report containing 
a review of the use of information shared with the 
Federal Government under this section, including— 
‘‘(A) a review of the use by the Federal Gov-
ernment of such information for a purpose other 
than a cybersecurity purpose; 
‘‘(B) a review of the type of information 
shared with the Federal Government under this 
section; 
‘‘(C) a review of the actions taken by the 
Federal Government based on such information; 
‘‘(D) appropriate metrics to determine the 
impact of the sharing of such information with 
the Federal Government on privacy and civil lib-
erties, if any; 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(E) a list of the departments or agencies 
receiving such information; 
‘‘(F) a review of the sharing of such infor-
mation within the Federal Government to iden-
tify inappropriate stovepiping of shared infor-
mation; and 
‘‘(G) any recommendations of the Inspector 
General for improvements or modifications to the 
authorities under this section. 
‘‘(2) PRIVACY AND CIVIL LIBERTIES OFFICERS 
REPORT.—The Civil Liberties Protection Officer of 
the Office of the Director of National Intelligence and 
the Chief Privacy and Civil Liberties Officer of the 
Department of Justice, in consultation with the Pri-
vacy and Civil Liberties Oversight Board, the Inspec-
tor General of the Intelligence Community, and the 
senior privacy and civil liberties officer of each de-
partment or agency of the Federal Government that 
receives cyber threat information shared with the Fed-
eral Government under this section, shall annually 
and jointly submit to Congress a report assessing the 
privacy and civil liberties impact of the activities 
conducted by the Federal Government under this sec-
tion. Such report shall include any recommendations 
the Civil Liberties Protection Officer and Chief Pri-
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
vacy and Civil Liberties Officer consider appropriate 
to minimize or mitigate the privacy and civil lib-
erties impact of the sharing of cyber threat informa-
tion under this section. 
‘‘(3) FORM.—Each report required under para-
graph (1) or (2) shall be submitted in unclassified 
form, but may include a classified annex. 
‘‘(f) FEDERAL PREEMPTION.—This section supersedes 
any statute of a State or political subdivision of a State 
that restricts or otherwise expressly regulates an activity 
authorized under subsection (b). 
‘‘(g) SAVINGS CLAUSES.— 
‘‘(1) EXISTING AUTHORITIES.—Nothing in this 
section shall be construed to limit any other authority 
to use a cybersecurity system or to identify, obtain, 
or share cyber threat intelligence or cyber threat in-
formation. 
‘‘(2) LIMITATION
ON
MILITARY
AND
INTEL-
LIGENCE COMMUNITY INVOLVEMENT IN PRIVATE AND 
PUBLIC SECTOR CYBERSECURITY EFFORTS.—Nothing 
in this section shall be construed to provide addi-
tional authority to, or modify an existing authority 
of, the Department of Defense or the National Secu-
rity Agency or any other element of the intelligence 
community to control, modify, require, or otherwise 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
direct the cybersecurity efforts of a private-sector enti-
ty or a component of the Federal Government or a 
State, local, or tribal government. 
‘‘(3) INFORMATION SHARING RELATIONSHIPS.— 
Nothing in this section shall be construed to— 
‘‘(A) limit or modify an existing informa-
tion sharing relationship; 
‘‘(B) prohibit a new information sharing 
relationship; 
‘‘(C) require a new information sharing re-
lationship between the Federal Government and 
a private-sector entity or utility; 
‘‘(D) modify the authority of a department 
or agency of the Federal Government to protect 
sources and methods and the national security of 
the United States; or 
‘‘(E) preclude the Federal Government from 
requiring an entity to report significant cyber 
incidents if authorized or required to do so under 
another provision of law. 
‘‘(4) LIMITATION ON FEDERAL GOVERNMENT USE 
OF CYBERSECURITY SYSTEMS.—Nothing in this sec-
tion shall be construed to provide additional author-
ity to, or modify an existing authority of, any entity 
to use a cybersecurity system owned or controlled by 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
the Federal Government on a private-sector system or 
network to protect such private-sector system or net-
work. 
‘‘(5) NO LIABILITY FOR NON-PARTICIPATION.— 
Nothing in this section shall be construed to subject 
a protected entity, self-protected entity, cyber security 
provider, or an officer, employee, or agent of a pro-
tected entity, self-protected entity, or cybersecurity 
provider, to liability for choosing not to engage in the 
voluntary activities authorized under this section. 
‘‘(6) USE AND RETENTION OF INFORMATION.— 
Nothing in this section shall be construed to author-
ize, or to modify any existing authority of, a depart-
ment or agency of the Federal Government to retain 
or use information shared pursuant to subsection 
(b)(1) for any use other than a use permitted under 
subsection (c)(1). 
‘‘(h) DEFINITIONS.—In this section: 
‘‘(1) AVAILABILITY.—The term ‘availability’ 
means ensuring timely and reliable access to and use 
of information. 
‘‘(2) CERTIFIED ENTITY.—The term ‘certified en-
tity’ means a protected entity, self-protected entity, or 
cybersecurity provider that— 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(A) possesses or is eligible to obtain a secu-
rity clearance, as determined by the Director of 
National Intelligence; and 
‘‘(B) is able to demonstrate to the Director 
of National Intelligence that such provider or 
such entity can appropriately protect classified 
cyber threat intelligence. 
‘‘(3) CONFIDENTIALITY.—The term ‘confiden-
tiality’ means preserving authorized restrictions on 
access and disclosure, including means for protecting 
personal privacy and proprietary information. 
‘‘(4) CYBER THREAT INFORMATION.— 
‘‘(A) IN GENERAL.—The term ‘cyber threat 
information’ means information directly per-
taining to— 
‘‘(i) a vulnerability of a system or net-
work of a government or private entity or 
utility; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network of a government or private entity 
or utility or any information stored on, 
processed on, or transiting such a system or 
network; 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work of a government or private entity or 
utility; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network of a government 
or private entity or utility, including to 
gain such unauthorized access for the pur-
pose of exfiltrating information stored on, 
processed on, or transiting a system or net-
work of a government or private entity or 
utility. 
‘‘(B) EXCLUSION.—Such term does not in-
clude information pertaining to efforts to gain 
unauthorized access to a system or network of a 
government or private entity or utility that sole-
ly involve violations of consumer terms of service 
or consumer licensing agreements and do not 
otherwise constitute unauthorized access. 
‘‘(5) CYBER THREAT INTELLIGENCE.— 
‘‘(A) IN GENERAL.—The term ‘cyber threat 
intelligence’ means intelligence in the possession 
of an element of the intelligence community di-
rectly pertaining to— 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(i) a vulnerability of a system or net-
work of a government or private entity or 
utility; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network of a government or private entity 
or utility or any information stored on, 
processed on, or transiting such a system or 
network; 
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work of a government or private entity or 
utility; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network of a government 
or private entity or utility, including to 
gain such unauthorized access for the pur-
pose of exfiltrating information stored on, 
processed on, or transiting a system or net-
work of a government or private entity or 
utility. 
‘‘(B) EXCLUSION.—Such term does not in-
clude intelligence pertaining to efforts to gain 
unauthorized access to a system or network of a 
government or private entity or utility that sole-
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
ly involve violations of consumer terms of service 
or consumer licensing agreements and do not 
otherwise constitute unauthorized access. 
‘‘(6) CYBERSECURITY CRIME.—The term ‘cyber-
security crime’ means— 
‘‘(A) a crime under a Federal or State law 
that involves— 
‘‘(i) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work; 
‘‘(ii) efforts to gain unauthorized ac-
cess to a system or network; or 
‘‘(iii) efforts to exfiltrate information 
from a system or network without author-
ization; or 
‘‘(B) the violation of a provision of Federal 
law relating to computer crimes, including a 
violation of any provision of title 18, United 
States Code, created or amended by the Com-
puter Fraud and Abuse Act of 1986 (Public Law 
99–474). 
‘‘(7) CYBERSECURITY PROVIDER.—The term ‘cy-
bersecurity provider’ means a non-Federal entity that 
provides goods or services intended to be used for cy-
bersecurity purposes. 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(8) CYBERSECURITY PURPOSE.— 
‘‘(A) IN GENERAL.—The term ‘cybersecurity 
purpose’ means the purpose of ensuring the in-
tegrity, confidentiality, or availability of, or 
safeguarding, a system or network, including 
protecting a system or network from— 
‘‘(i) a vulnerability of a system or net-
work; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network or any information stored on, proc-
essed on, or transiting such a system or net-
work; 
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network, including to 
gain such unauthorized access for the pur-
pose of exfiltrating information stored on, 
processed on, or transiting a system or net-
work. 
‘‘(B) EXCLUSION.—Such term does not in-
clude the purpose of protecting a system or net-
work from efforts to gain unauthorized access to 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
such system or network that solely involve viola-
tions of consumer terms of service or consumer 
licensing agreements and do not otherwise con-
stitute unauthorized access. 
‘‘(9) CYBERSECURITY SYSTEM.— 
‘‘(A) IN GENERAL.—The term ‘cybersecurity 
system’ means a system designed or employed to 
ensure the integrity, confidentiality, or avail-
ability of, or safeguard, a system or network, in-
cluding protecting a system or network from— 
‘‘(i) a vulnerability of a system or net-
work; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network or any information stored on, proc-
essed on, or transiting such a system or net-
work; 
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network, including to 
gain such unauthorized access for the pur-
pose of exfiltrating information stored on, 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
processed on, or transiting a system or net-
work. 
‘‘(B) EXCLUSION.—Such term does not in-
clude a system designed or employed to protect 
a system or network from efforts to gain unau-
thorized access to such system or network that 
solely involve violations of consumer terms of 
service or consumer licensing agreements and do 
not otherwise constitute unauthorized access. 
‘‘(10) INTEGRITY.—The term ‘integrity’ means 
guarding against improper information modification 
or destruction, including ensuring information non-
repudiation and authenticity. 
‘‘(11) PROTECTED ENTITY.—The term ‘protected 
entity’ means an entity, other than an individual, 
that contracts with a cybersecurity provider for goods 
or services to be used for cybersecurity purposes. 
‘‘(12) SELF-PROTECTED ENTITY.—The term ‘self- 
protected entity’ means an entity, other than an indi-
vidual, that provides goods or services for cybersecu-
rity purposes to itself. 
‘‘(13) UTILITY.—The term ‘utility’ means an en-
tity providing essential services (other than law en-
forcement or regulatory services), including elec-
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
tricity, natural gas, propane, telecommunications, 
transportation, water, or wastewater services.’’. 
(b) PROCEDURES AND GUIDELINES.—The Director of 
National Intelligence shall— 
(1) not later than 60 days after the date of the 
enactment of this Act, establish procedures under 
paragraph (1) of section 1104(a) of the National Se-
curity Act of 1947, as added by subsection (a) of this 
section, and issue guidelines under paragraph (3) of 
such section 1104(a); 
(2) in establishing such procedures and issuing 
such guidelines, consult with the Secretary of Home-
land Security to ensure that such procedures and such 
guidelines permit the owners and operators of critical 
infrastructure to receive all appropriate cyber threat 
intelligence (as defined in section 1104(h)(5) of such 
Act, as added by subsection (a)) in the possession of 
the Federal Government; and 
(3) following the establishment of such proce-
dures and the issuance of such guidelines, expedi-
tiously distribute such procedures and such guidelines 
to appropriate departments and agencies of the Fed-
eral Government, private-sector entities, and utilities 
(as defined in section 1104(h)(13) of such Act, as 
added by subsection (a)). 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
(c) PRIVACY
AND CIVIL LIBERTIES POLICIES
AND 
PROCEDURES.—Not later than 60 days after the date of the 
enactment of this Act, the Director of National Intelligence, 
in consultation with the Secretary of Homeland Security 
and the Attorney General, shall establish the policies and 
procedures required under section 1104(c)(7)(A) of the Na-
tional Security Act of 1947, as added by subsection (a) of 
this section. 
(d) INITIAL REPORTS.—The first reports required to 
be submitted under paragraphs (1) and (2) of subsection 
(e) of section 1104 of the National Security Act of 1947, 
as added by subsection (a) of this section, shall be submitted 
not later than 1 year after the date of the enactment of this 
Act. 
(e) TABLE OF CONTENTS AMENDMENT.—The table of 
contents in the first section of the National Security Act 
of 1947 is amended by adding at the end the following new 
item: 
‘‘Sec. 1104. Cyber threat intelligence and information sharing.’’. 
SEC. 3. SUNSET. 
Effective on the date that is 5 years after the date of 
the enactment of this Act— 
(1) section 1104 of the National Security Act of 
1947, as added by section 2(a) of this Act, is repealed; 
and 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
(2) the table of contents in the first section of the 
National Security Act of 1947, as amended by section 
2(e) of this Act, is amended by striking the item relat-
ing to section 1104, as added by such section 2(e). 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
Union Calendar No. 25 
113TH CONGRESS 
1ST SESSION 
H. R. 624 
[Report No. 113–39] 
A BILL 
To provide for the sharing of certain cyber threat 
intelligence and cyber threat information between 
the intelligence community and cybersecurity en-
tities, and for other purposes. 
APRIL 15, 2013 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00034
Fmt 6651
Sfmt 6651
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS