SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber Diplomacy Act 
of 2017’’. 
SEC. 2. FINDINGS. 
Congress finds the following: 
(1) The stated goal of the United States Inter-
national Strategy for Cyberspace, launched on May 
16, 2011, is to ‘‘work internationally to promote an 
open, interoperable, secure, and reliable information 
and communications infrastructure that supports 
international trade and commerce, strengthens inter-
national security, and fosters free expression and in-
novation * * * in which norms of responsible behav-
ior guide States’ actions, sustain partnerships, and 
support the rule of law in cyberspace.’’. 
(2) The Group of Governmental Experts (GGE) 
on Developments in the Field of Information and 
Telecommunications in the Context of International 
Security, established by the United Nations General 
Assembly, concluded in its June 24, 2013, report 
‘‘that State sovereignty and the international norms 
and principles that flow from it apply to States’ con-
duct of [information and communications technology 
or ICT] related activities and to their jurisdiction 
over ICT infrastructure with their territory.’’.
(3) On January 13, 2015, China, Kazakhstan, 
Kyrgyzstan, Russia, Tajikistan, and Uzbekistan pro-
posed a troubling international code of conduct for 
information security which defines responsible State 
behavior in cyberspace to include ‘‘curbing the dis-
semination of information’’ and the ‘‘right to inde-
pendent control of information and communications 
technology’’ when a country’s political security is 
threatened. 
(4) The July 22, 2015, GGE consensus report 
found that, ‘‘norms of responsible State behavior can 
reduce risks to international peace, security and sta-
bility.’’. 
(5) On September 25, 2015, the United States 
and China announced a commitment ‘‘that neither 
country’s government will conduct or knowingly sup-
port cyber-enabled theft of intellectual property, in-
cluding trade secrets or other confidential business 
information, with the intent of providing competitive 
advantages to companies or commercial sectors.’’. 
(6) At the Antalya Summit from November 15– 
16, 2015, the Group of 20 (G20) Leaders’ Commu-
nique affirmed the applicability of international law 
to State behavior in cyberspace, called on States to 
refrain from cyber-enabled theft of intellectual prop-
erty for commercial gain, and endorsed the view that 
all States should abide by norms of responsible be-
havior. 
(7) The March 2016 Department of State 
International Cyberspace Policy Strategy noted that, 
‘‘the Department of State anticipates a continued in-
crease and expansion of our cyber-focused diplomatic 
efforts for the foreseeable future.’’. 
(8) On December 1, 2016, the Commission on 
Enhancing National Cybersecurity established within 
the Department of Commerce recommended ‘‘the 
President should appoint an Ambassador for Cyber-
security to lead U.S. engagement with the inter-
national community on cybersecurity strategies, 
standards, and practices.’’. 
(9) The 2017 Group of 7 (G7) Declaration on 
Responsible States Behavior in Cyberspace recog-
nized on April 11, 2017, ‘‘the urgent necessity of in-
creased international cooperation to promote secu-
rity and stability in cyberspace * * * consisting of 
the applicability of existing international law to 
State behavior in cyberspace, the promotion of vol-
untary, non-binding norms of responsible State be-
havior during peacetime’’ and reaffirmed ‘‘that the
same rights that people have offline must also be 
protected online.’’. 
(10) In testimony before the Select Committee 
on Intelligence of the Senate on May 11, 2017, the 
Director of National Intelligence identified six cyber 
threat actors, including Russia for ‘‘efforts to influ-
ence the 2016 US election’’; China, for ‘‘actively tar-
geting the US Government, its allies, and US com-
panies for cyber espionage’’; Iran for ‘‘leverage[ing] 
cyber espionage, propaganda, and attacks to support 
its security priorities, influence events and foreign 
perceptions, and counter threats’’; North Korea for 
‘‘previously conduct[ing] cyber-attacks against US 
commercial entities—specifically, Sony Pictures En-
tertainment in 2014’’; terrorists, who ‘‘use the Inter-
net to organize, recruit, spread propaganda, raise 
funds, collect intelligence, inspire action by followers, 
and coordinate operations’’; and criminals who ‘‘are 
also developing and using sophisticated cyber tools 
for a variety of purposes including theft, extortion, 
and facilitation of other criminal activities’’. 
(11) On May 11, 2017, President Trump issued 
Presidential 
Executive 
Order 
No. 
13800 
on 
Strengthening the Cybersecurity of Federal Net-
works and Infrastructure which designated the Sec-
retary of State to lead an interagency effort to de-
velop strategic options for the President to deter ad-
versaries from cyber threats and an engagement 
strategy for international cooperation in cybersecu-
rity, noting that ‘‘the United States is especially de-
pendent on a globally secure and resilient internet 
and must work with allies and other partners’’ to-
ward maintaining ‘‘the policy of the executive branch 
to promote an open, interoperable, reliable, and se-
cure internet that fosters efficiency, innovation, com-
munication, and economic prosperity, while respect-
ing privacy and guarding against deception, fraud, 
and theft.’’. 
SEC. 3. UNITED STATES INTERNATIONAL CYBERSPACE 
POLICY. 
(a) IN GENERAL.—Congress declares that it is the 
policy of the United States to work internationally with 
allies and other partners to promote an open, interoper-
able, reliable, unfettered, and secure internet governed by 
the multistakeholder model which promotes human rights, 
democracy, and rule of law, including freedom of expres-
sion, innovation, communication, and economic prosperity, 
while respecting privacy and guarding against deception, 
fraud, and theft.
(b) IMPLEMENTATION.—In implementing the policy 
described in subsection (a), the President, in consultation 
with outside actors, including technology companies, non-
governmental organizations, security researchers, and 
other relevant stakeholders, shall pursue the following ob-
jectives in the conduct of bilateral and multilateral rela-
tions: 
(1) Clarifying the applicability of international 
laws and norms, including the law of armed conflict, 
to the use of ICT. 
(2) Clarifying that countries that fall victim to 
malicious cyber activities have the right to take pro-
portionate countermeasures under international law, 
provided such measures do not violate a funda-
mental human right or peremptory norm. 
(3) Reducing and limiting the risk of escalation 
and retaliation in cyberspace, such as massive de-
nial-of-service attacks, damage to critical infrastruc-
ture, or other malicious cyber activity that impairs 
the use and operation of critical infrastructure that 
provides services to the public. 
(4) Cooperating with like-minded democratic 
countries that share common values and cyberspace 
policies with the United States, including respect for
human rights, democracy, and rule of law, to ad-
vance such values and policies internationally. 
(5) Securing and implementing commitments 
on responsible country behavior in cyberspace based 
upon accepted norms, including the following: 
(A) Countries should not conduct or know-
ingly support cyber-enabled theft of intellectual 
property, including trade secrets or other con-
fidential business information, with the intent 
of providing competitive advantages to compa-
nies or commercial sectors. 
(B) Countries should cooperate in devel-
oping and applying measures to increase sta-
bility and security in the use of ICTs and to 
prevent ICT practices that are acknowledged to 
be harmful or that may pose threats to inter-
national peace and security. 
(C) Countries should take all appropriate 
and reasonable efforts to keep their territories 
clear of intentionally wrongful acts using ICTs 
in violation of international commitments. 
(D) Countries should not conduct or know-
ingly support ICT activity that, contrary to 
international law, intentionally damages or oth-
erwise impairs the use and operation of critical
infrastructure, and should take appropriate 
measures to protect their critical infrastructure 
from ICT threats. 
(E) Countries should not conduct or know-
ingly support malicious international activity 
that, contrary to international law, harms the 
information systems of authorized emergency 
response teams (sometimes known as ‘‘com-
puter emergency response teams’’ or ‘‘cyberse-
curity incident response teams’’) or related pri-
vate sector companies of another country. 
(F) Countries should identify economic 
drivers and incentives to promote securely-de-
signed ICT products and to develop policy and 
legal frameworks to promote the development of 
secure internet architecture. 
(G) Countries should respond to appro-
priate requests for assistance to mitigate mali-
cious ICT activity aimed at the critical infra-
structure of another country emanating from 
their territory. 
(H) Countries should not restrict cross- 
border data flows or require local storage or 
processing of data.
(I) Countries should protect the exercise of 
human rights and fundamental freedoms on the 
Internet and commit to the principle that the 
human rights that people have offline enjoy the 
same protections online. 
SEC. 4. DEPARTMENT OF STATE RESPONSIBILITIES. 
(a) OFFICE OF CYBER ISSUES.—Section 1 of the 
State Department Basic Authorities Act of 1956 (22 
U.S.C. 2651a) is amended— 
(1) by redesignating subsection (g) as sub-
section (h); and 
(2) by inserting after subsection (f) the fol-
lowing new subsection: 
‘‘(g) OFFICE OF CYBER ISSUES.— 
‘‘(1) IN GENERAL.—There is established an Of-
fice of Cyber Issues (in this subsection referred to 
as the ‘Office’). The head of the Office shall have 
the rank and status of ambassador and be appointed 
by the President, by and with the advice and consent 
of the Senate. 
‘‘(2) DUTIES.— 
‘‘(A) IN GENERAL.—The head of the Of-
fice shall perform such duties and exercise such 
powers as the Secretary of State shall prescribe, 
including implementing the policy of the United
States described in section 3 of the Cyber Di-
plomacy Act of 2017. 
‘‘(B) DUTIES DESCRIBED.—The principal 
duties of the head of the Office shall be to— 
‘‘(i) serve as the principal cyber-policy 
official within the senior management of 
the Department of State and advisor to 
the Secretary of State for cyber issues; 
‘‘(ii) lead the Department of State’s 
diplomatic cyberspace efforts generally, in-
cluding relating to international cybersecu-
rity, internet access, internet freedom, dig-
ital economy, cybercrime, deterrence and 
international responses to cyber threats; 
‘‘(iii) promote an open, interoperable, 
reliable, unfettered, and secure information 
and communications technology infrastruc-
ture globally; 
‘‘(iv) represent the Secretary of State 
in interagency efforts to develop and ad-
vance the United States international 
cyberspace policy; 
‘‘(v) coordinate within the Depart-
ment of State and with other components 
of the United States Government cyber-
space efforts and other relevant functions, 
including countering terrorists’ use of 
cyberspace; and 
‘‘(vi) act as liaison to public and pri-
vate sector entities on relevant cyberspace 
issues. 
‘‘(3) QUALIFICATIONS.—The head of the Office 
should be an individual of demonstrated competency 
in the field of— 
‘‘(A) cybersecurity and other relevant cyber 
issues; and 
‘‘(B) international diplomacy. 
‘‘(4) ORGANIZATIONAL PLACEMENT.—The head 
of the Office shall report to the Under Secretary for 
Political Affairs or official holding a higher position 
in the Department of State. 
‘‘(5) RULE
OF
CONSTRUCTION.—Nothing in 
this subsection may be construed as precluding— 
‘‘(A) the Office from being elevated to a 
Bureau of the Department of State; and 
‘‘(B) the head of the Office from being ele-
vated to an Assistant Secretary, if such an As-
sistant Secretary position does not increase the 
number of Assistant Secretary positions at the