I 
113TH CONGRESS 
1ST SESSION 
H. R. 624 
To provide for the sharing of certain cyber threat intelligence and cyber 
threat information between the intelligence community and cybersecurity 
entities, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 13, 2013 
Mr. ROGERS of Michigan (for himself and Mr. RUPPERSBERGER) introduced 
the following bill; which was referred to the Select Committee on Intel-
ligence (Permanent Select) 
A BILL 
To provide for the sharing of certain cyber threat intelligence 
and cyber threat information between the intelligence 
community and cybersecurity entities, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber Intelligence 
Sharing and Protection Act’’. 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
SEC. 2. CYBER THREAT INTELLIGENCE AND INFORMATION 
SHARING. 
(a) IN GENERAL.—Title XI of the National Security 
Act of 1947 (50 U.S.C. 442 et seq.) is amended by adding 
at the end the following new section: 
‘‘CYBER THREAT INTELLIGENCE AND INFORMATION 
SHARING 
‘‘SEC. 1104. (a) INTELLIGENCE COMMUNITY SHAR-
ING OF CYBER THREAT INTELLIGENCE WITH PRIVATE 
SECTOR AND UTILITIES.— 
‘‘(1) IN GENERAL.—The Director of National 
Intelligence shall establish procedures to allow ele-
ments of the intelligence community to share cyber 
threat intelligence with private-sector entities and 
utilities and to encourage the sharing of such intel-
ligence. 
‘‘(2) SHARING AND USE OF CLASSIFIED INTEL-
LIGENCE.—The procedures established under para-
graph (1) shall provide that classified cyber threat 
intelligence may only be— 
‘‘(A) shared by an element of the intel-
ligence community with— 
‘‘(i) a certified entity; or 
‘‘(ii) a person with an appropriate se-
curity clearance to receive such cyber 
threat intelligence; 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(B) shared consistent with the need to 
protect the national security of the United 
States; and 
‘‘(C) used by a certified entity in a manner 
which protects such cyber threat intelligence 
from unauthorized disclosure. 
‘‘(3) SECURITY CLEARANCE APPROVALS.—The 
Director of National Intelligence shall issue guide-
lines providing that the head of an element of the 
intelligence community may, as the head of such ele-
ment considers necessary to carry out this sub-
section— 
‘‘(A) grant a security clearance on a tem-
porary or permanent basis to an employee or 
officer of a certified entity; 
‘‘(B) grant a security clearance on a tem-
porary or permanent basis to a certified entity 
and approval to use appropriate facilities; and 
‘‘(C) expedite the security clearance proc-
ess for a person or entity as the head of such 
element considers necessary, consistent with the 
need to protect the national security of the 
United States. 
‘‘(4) NO RIGHT OR BENEFIT.—The provision of 
information to a private-sector entity or a utility 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
under this subsection shall not create a right or ben-
efit to similar information by such entity or such 
utility or any other private-sector entity or utility. 
‘‘(5) RESTRICTION ON DISCLOSURE OF CYBER 
THREAT
INTELLIGENCE.—Notwithstanding 
any 
other provision of law, a certified entity receiving 
cyber threat intelligence pursuant to this subsection 
shall not further disclose such cyber threat intel-
ligence to another entity, other than to a certified 
entity or other appropriate agency or department of 
the Federal Government authorized to receive such 
cyber threat intelligence. 
‘‘(b) USE OF CYBERSECURITY SYSTEMS AND SHAR-
ING OF CYBER THREAT INFORMATION.— 
‘‘(1) IN GENERAL.— 
‘‘(A) CYBERSECURITY
PROVIDERS.—Not-
withstanding any other provision of law, a cy-
bersecurity provider, with the express consent 
of a protected entity for which such cybersecu-
rity provider is providing goods or services for 
cybersecurity purposes, may, for cybersecurity 
purposes— 
‘‘(i) use cybersecurity systems to iden-
tify and obtain cyber threat information to 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
Federal or State court against a protected entity, 
self-protected entity, cybersecurity provider, or an 
officer, employee, or agent of a protected entity, self- 
protected entity, or cybersecurity provider, acting in 
good faith— 
‘‘(A) for using cybersecurity systems to 
identify or obtain cyber threat information or 
for sharing such information in accordance with 
this section; or 
‘‘(B) for decisions made based on cyber 
threat information identified, obtained, or 
shared under this section. 
‘‘(5) RELATIONSHIP TO OTHER LAWS REQUIR-
ING THE DISCLOSURE OF INFORMATION.—The sub-
mission of information under this subsection to the 
Federal Government shall not satisfy or affect— 
‘‘(A) any requirement under any other pro-
vision of law for a person or entity to provide 
information to the Federal Government; or 
‘‘(B) the applicability of other provisions of 
law, including section 552 of title 5, United 
States Code (commonly known as the ‘Freedom 
of Information Act’), with respect to informa-
tion required to be provided to the Federal Gov-
ernment under such other provision of law. 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(c) FEDERAL GOVERNMENT USE
OF INFORMA-
TION.— 
‘‘(1) LIMITATION.—The Federal Government 
may use cyber threat information shared with the 
Federal Government in accordance with subsection 
(b)— 
‘‘(A) for cybersecurity purposes; 
‘‘(B) for the investigation and prosecution 
of cybersecurity crimes; 
‘‘(C) for the protection of individuals from 
the danger of death or serious bodily harm and 
the investigation and prosecution of crimes in-
volving such danger of death or serious bodily 
harm; 
‘‘(D) for the protection of minors from 
child pornography, any risk of sexual exploi-
tation, and serious threats to the physical safe-
ty of minors, including kidnapping and traf-
ficking and the investigation and prosecution of 
crimes involving child pornography, any risk of 
sexual exploitation, and serious threats to the 
physical safety of minors, including kidnapping 
and trafficking, and any crime referred to in 
section 2258A(a)(2) of title 18, United States 
Code; or 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(E) to protect the national security of the 
United States. 
‘‘(2) AFFIRMATIVE
SEARCH
RESTRICTION.— 
The Federal Government may not affirmatively 
search cyber threat information shared with the 
Federal Government under subsection (b) for a pur-
pose other than a purpose referred to in paragraph 
(1)(B). 
‘‘(3) ANTI-TASKING RESTRICTION.—Nothing in 
this section shall be construed to permit the Federal 
Government to— 
‘‘(A) require a private-sector entity to 
share information with the Federal Govern-
ment; or 
‘‘(B) condition the sharing of cyber threat 
intelligence with a private-sector entity on the 
provision of cyber threat information to the 
Federal Government. 
‘‘(4) PROTECTION
OF
SENSITIVE
PERSONAL 
DOCUMENTS.—The Federal Government may not 
use the following information, containing informa-
tion that identifies a person, shared with the Federal 
Government in accordance with subsection (b): 
‘‘(A) Library circulation records. 
‘‘(B) Library patron lists. 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(C) Book sales records. 
‘‘(D) Book customer lists. 
‘‘(E) Firearms sales records. 
‘‘(F) Tax return records. 
‘‘(G) Educational records. 
‘‘(H) Medical records. 
‘‘(5) NOTIFICATION OF NON-CYBER THREAT IN-
FORMATION.—If a department or agency of the Fed-
eral Government receiving information pursuant to 
subsection (b)(1) determines that such information 
is not cyber threat information, such department or 
agency shall notify the entity or provider sharing 
such information pursuant to subsection (b)(1). 
‘‘(6) RETENTION AND USE OF CYBER THREAT 
INFORMATION.—No department or agency of the 
Federal Government shall retain or use information 
shared pursuant to subsection (b)(1) for any use 
other than a use permitted under subsection (c)(1). 
‘‘(7) PROTECTION
OF
INDIVIDUAL
INFORMA-
TION.—The Federal Government may, consistent 
with the need to protect Federal systems and critical 
information 
infrastructure 
from 
cybersecurity 
threats and to mitigate such threats, undertake rea-
sonable efforts to limit the impact on privacy and 
civil liberties of the sharing of cyber threat informa-
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
tion with the Federal Government pursuant to this 
subsection. 
‘‘(d) FEDERAL GOVERNMENT LIABILITY FOR VIOLA-
TIONS OF RESTRICTIONS ON THE DISCLOSURE, USE, AND 
PROTECTION OF VOLUNTARILY SHARED INFORMATION.— 
‘‘(1) IN GENERAL.—If a department or agency 
of the Federal Government intentionally or willfully 
violates subsection (b)(3)(C) or subsection (c) with 
respect to the disclosure, use, or protection of volun-
tarily shared cyber threat information shared under 
this section, the United States shall be liable to a 
person adversely affected by such violation in an 
amount equal to the sum of— 
‘‘(A) the actual damages sustained by the 
person as a result of the violation or $1,000, 
whichever is greater; and 
‘‘(B) the costs of the action together with 
reasonable attorney fees as determined by the 
court. 
‘‘(2) VENUE.—An action to enforce liability cre-
ated under this subsection may be brought in the 
district court of the United States in— 
‘‘(A) the district in which the complainant 
resides; 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(B) the district in which the principal 
place of business of the complainant is located; 
‘‘(C) the district in which the department 
or agency of the Federal Government that dis-
closed the information is located; or 
‘‘(D) the District of Columbia. 
‘‘(3) STATUTE
OF
LIMITATIONS.—No action 
shall lie under this subsection unless such action is 
commenced not later than two years after the date 
of the violation of subsection (b)(3)(C) or subsection 
(c) that is the basis for the action. 
‘‘(4) EXCLUSIVE CAUSE OF ACTION.—A cause 
of action under this subsection shall be the exclusive 
means available to a complainant seeking a remedy 
for a violation of subsection (b)(3)(C) or subsection 
(c). 
‘‘(e) REPORT ON INFORMATION SHARING.— 
‘‘(1) REPORT.—The Inspector General of the 
Intelligence Community shall annually submit to the 
congressional intelligence committees a report con-
taining a review of the use of information shared 
with the Federal Government under this section, in-
cluding— 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(A) a review of the use by the Federal 
Government of such information for a purpose 
other than a cybersecurity purpose; 
‘‘(B) a review of the type of information 
shared with the Federal Government under this 
section; 
‘‘(C) a review of the actions taken by the 
Federal Government based on such information; 
‘‘(D) appropriate metrics to determine the 
impact of the sharing of such information with 
the Federal Government on privacy and civil 
liberties, if any; 
‘‘(E) a list of the departments or agencies 
receiving such information; 
‘‘(F) a review of the sharing of such infor-
mation within the Federal Government to iden-
tify inappropriate stovepiping of shared infor-
mation; and 
‘‘(G) any recommendations of the Inspec-
tor General for improvements or modifications 
to the authorities under this section. 
‘‘(2) FORM.—Each report required under para-
graph (1) shall be submitted in unclassified form, 
but may include a classified annex. 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(f) FEDERAL PREEMPTION.—This section super-
sedes any statute of a State or political subdivision of a 
State that restricts or otherwise expressly regulates an ac-
tivity authorized under subsection (b). 
‘‘(g) SAVINGS CLAUSES.— 
‘‘(1) EXISTING AUTHORITIES.—Nothing in this 
section shall be construed to limit any other author-
ity to use a cybersecurity system or to identify, ob-
tain, or share cyber threat intelligence or cyber 
threat information. 
‘‘(2) LIMITATION
ON
MILITARY
AND
INTEL-
LIGENCE
COMMUNITY
INVOLVEMENT
IN
PRIVATE 
AND PUBLIC SECTOR CYBERSECURITY EFFORTS.— 
Nothing in this section shall be construed to provide 
additional authority to, or modify an existing au-
thority of, the Department of Defense or the Na-
tional Security Agency or any other element of the 
intelligence community to control, modify, require, 
or otherwise direct the cybersecurity efforts of a pri-
vate-sector entity or a component of the Federal 
Government or a State, local, or tribal government. 
‘‘(3) INFORMATION SHARING RELATIONSHIPS.— 
Nothing in this section shall be construed to— 
‘‘(A) limit or modify an existing informa-
tion sharing relationship; 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(B) prohibit a new information sharing 
relationship; 
‘‘(C) require a new information sharing re-
lationship between the Federal Government and 
a private-sector entity; or 
‘‘(D) modify the authority of a department 
or agency of the Federal Government to protect 
sources and methods and the national security 
of the United States. 
‘‘(4) LIMITATION
ON
FEDERAL
GOVERNMENT 
USE OF CYBERSECURITY SYSTEMS.—Nothing in this 
section shall be construed to provide additional au-
thority to, or modify an existing authority of, any 
entity to use a cybersecurity system owned or con-
trolled by the Federal Government on a private-sec-
tor system or network to protect such private-sector 
system or network. 
‘‘(5) NO LIABILITY FOR NON-PARTICIPATION.— 
Nothing in this section shall be construed to subject 
a protected entity, self-protected entity, cyber secu-
rity provider, or an officer, employee, or agent of a 
protected entity, self-protected entity, or cybersecu-
rity provider, to liability for choosing not to engage 
in the voluntary activities authorized under this sec-
tion. 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(6) USE AND RETENTION OF INFORMATION.— 
Nothing in this section shall be construed to author-
ize, or to modify any existing authority of, a depart-
ment or agency of the Federal Government to retain 
or use information shared pursuant to subsection 
(b)(1) for any use other than a use permitted under 
subsection (c)(1). 
‘‘(h) DEFINITIONS.—In this section: 
‘‘(1) AVAILABILITY.—The term ‘availability’ 
means ensuring timely and reliable access to and use 
of information. 
‘‘(2) CERTIFIED ENTITY.—The term ‘certified 
entity’ means a protected entity, self-protected enti-
ty, or cybersecurity provider that— 
‘‘(A) possesses or is eligible to obtain a se-
curity clearance, as determined by the Director 
of National Intelligence; and 
‘‘(B) is able to demonstrate to the Director 
of National Intelligence that such provider or 
such entity can appropriately protect classified 
cyber threat intelligence. 
‘‘(3) CONFIDENTIALITY.—The term ‘confiden-
tiality’ means preserving authorized restrictions on 
access and disclosure, including means for protecting 
personal privacy and proprietary information. 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(4) CYBER THREAT INFORMATION.— 
‘‘(A) IN
GENERAL.—The term ‘cyber 
threat information’ means information directly 
pertaining to— 
‘‘(i) a vulnerability of a system or net-
work of a government or private entity; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network of a government or private entity 
or any information stored on, processed on, 
or transiting such a system or network; 
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work of a government or private entity; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network of a govern-
ment or private entity, including to gain 
such unauthorized access for the purpose 
of exfiltrating information stored on, proc-
essed on, or transiting a system or network 
of a government or private entity. 
‘‘(B) EXCLUSION.— Such term does not 
include information pertaining to efforts to gain 
unauthorized access to a system or network of 
a government or private entity that solely in-
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
volve violations of consumer terms of service or 
consumer licensing agreements and do not oth-
erwise constitute unauthorized access. 
‘‘(5) CYBER THREAT INTELLIGENCE.— 
‘‘(A) IN
GENERAL.—The term ‘cyber 
threat intelligence’ means intelligence in the 
possession of an element of the intelligence 
community directly pertaining to— 
‘‘(i) a vulnerability of a system or net-
work of a government or private entity; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network of a government or private entity 
or any information stored on, processed on, 
or transiting such a system or network; 
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work of a government or private entity; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network of a govern-
ment or private entity, including to gain 
such unauthorized access for the purpose 
of exfiltrating information stored on, proc-
essed on, or transiting a system or network 
of a government or private entity. 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(B) EXCLUSION.— Such term does not 
include intelligence pertaining to efforts to gain 
unauthorized access to a system or network of 
a government or private entity that solely in-
volve violations of consumer terms of service or 
consumer licensing agreements and do not oth-
erwise constitute unauthorized access. 
‘‘(6) CYBERSECURITY
CRIME.—The term ‘cy-
bersecurity crime’ means— 
‘‘(A) a crime under a Federal or State law 
that involves— 
‘‘(i) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work; 
‘‘(ii) efforts to gain unauthorized ac-
cess to a system or network; or 
‘‘(iii) efforts to exfiltrate information 
from a system or network without author-
ization; or 
‘‘(B) the violation of a provision of Federal 
law relating to computer crimes, including a 
violation of any provision of title 18, United 
States Code, created or amended by the Com-
puter Fraud and Abuse Act of 1986 (Public 
Law 99–474). 
VerDate Mar 15 2010 
04:45 Feb 20, 2013
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H624.IH
H624
pwalker on DSK7TPTVN1PROD with BILLS