HR 1560 RDS
the Inspector General of the Department, and 
the senior privacy and civil liberties officer of 
each Federal agency that receives cyber threat 
indicators and defensive measures shared with 
the Center under this section, shall biennially 
submit to the appropriate congressional com-
mittees a report assessing the privacy and civil 
liberties impact of the activities under this 
paragraph. Each such report shall include any 
recommendations the Chief Privacy Officer and 
the Chief Civil Rights and Civil Liberties Offi-
cer of the Department consider appropriate to 
minimize or mitigate the privacy and civil lib-
erties impact of the sharing of cyber threat in-
dicators and defensive measures under this sec-
tion. 
‘‘(E) FORM.—Each report required under 
subparagraphs (C) and (D) shall be submitted 
in unclassified form, but may include a classi-
fied annex. 
‘‘(7) USES
AND
PROTECTION
OF
INFORMA-
TION.— 
‘‘(A) NON-FEDERAL
ENTITIES.—A non- 
Federal entity, not including a State, local, or 
tribal government, that shares cyber threat in-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
dicators or defensive measures through the Cen-
ter or otherwise under this section— 
‘‘(i) may use, retain, or further dis-
close such cyber threat indicators or defen-
sive measures solely for cybersecurity pur-
poses; 
‘‘(ii) shall, prior to such sharing, take 
reasonable efforts to remove or exclude in-
formation that can be used to identify spe-
cific persons and is reasonably believed at 
the time of sharing to be unrelated to a cy-
bersecurity risk or incident, and to safe-
guard information that can be used to 
identify specific persons from unintended 
disclosure or unauthorized access or acqui-
sition; 
‘‘(iii) shall comply with appropriate 
restrictions that a Federal entity or non- 
Federal entity places on the subsequent 
disclosure or retention of cyber threat indi-
cators and defensive measures that it dis-
closes to other Federal entities or non-Fed-
eral entities; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(iv) shall be deemed to have volun-
tarily shared such cyber threat indicators 
or defensive measures; 
‘‘(v) shall implement and utilize a se-
curity control to protect against unauthor-
ized access to or acquisition of such cyber 
threat indicators or defensive measures; 
and 
‘‘(vi) may not use such information to 
gain an unfair competitive advantage to 
the detriment of any non-Federal entity. 
‘‘(B) FEDERAL ENTITIES.— 
‘‘(i) USES OF INFORMATION.—A Fed-
eral entity that receives cyber threat indi-
cators 
or 
defensive 
measures 
shared 
through the Center or otherwise under this 
section from another Federal entity or a 
non-Federal entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators 
or defensive measures solely for cyber-
security purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove or 
exclude information that can be used 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
to identify specific persons and is rea-
sonably believed at the time of sharing 
to be unrelated to a cybersecurity risk 
or incident, and to safeguard informa-
tion that can be used to identify spe-
cific persons from unintended disclo-
sure or unauthorized access or acqui-
sition; 
‘‘(III) shall be deemed to have 
voluntarily shared such cyber threat 
indicators or defensive measures; 
‘‘(IV) shall implement and utilize 
a security control to protect against 
unauthorized access to or acquisition 
of such cyber threat indicators or de-
fensive measures; and 
‘‘(V) may not use such cyber 
threat indicators or defensive meas-
ures to engage in surveillance or other 
collection activities for the purpose of 
tracking an individual’s personally 
identifiable information, except for 
purposes authorized in this section. 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(ii) PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
‘‘(I) are exempt from disclosure 
under section 552 of title 5, United 
States Code, and withheld, without 
discretion, from the public under sub-
section (b)(3)(B) of such section; 
‘‘(II) may not be used by the 
Federal Government for regulatory 
purposes; 
‘‘(III) may not constitute a waiv-
er of any applicable privilege or pro-
tection provided by law, including 
trade secret protection; 
‘‘(IV) shall be considered the 
commercial, financial, and proprietary 
information of the non-Federal entity 
referred to in clause (i) when so des-
ignated by such non-Federal entity; 
and 
‘‘(V) may not be subject to a rule 
of any Federal entity or any judicial 
doctrine regarding ex parte commu-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
nications with a decisionmaking offi-
cial. 
‘‘(C) STATE, LOCAL, OR TRIBAL GOVERN-
MENT.— 
‘‘(i) 
USES
OF
INFORMATION.—A 
State, local, or tribal government that re-
ceives cyber threat indicators or defensive 
measures from the Center from a Federal 
entity or a non-Federal entity— 
‘‘(I) may use, retain, or further 
disclose such cyber threat indicators 
or defensive measures solely for cyber-
security purposes; 
‘‘(II) shall, prior to such sharing, 
take reasonable efforts to remove or 
exclude information that can be used 
to identify specific persons and is rea-
sonably believed at the time of sharing 
to be unrelated to a cybersecurity risk 
or incident, and to safeguard informa-
tion that can be used to identify spe-
cific persons from unintended disclo-
sure or unauthorized access or acqui-
sition; 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(III) shall consider such infor-
mation the commercial, financial, and 
proprietary information of such Fed-
eral entity or non-Federal entity if so 
designated by such Federal entity or 
non-Federal entity; 
‘‘(IV) shall be deemed to have 
voluntarily shared such cyber threat 
indicators or defensive measures; and 
‘‘(V) shall implement and utilize 
a security control to protect against 
unauthorized access to or acquisition 
of such cyber threat indicators or de-
fensive measures. 
‘‘(ii) PROTECTIONS
FOR
INFORMA-
TION.—The cyber threat indicators and de-
fensive measures referred to in clause (i)— 
‘‘(I) shall be exempt from disclo-
sure under any State, local, or tribal 
law or regulation that requires public 
disclosure of information or records 
by a public or quasi-public entity; and 
‘‘(II) may not be used by any 
State, local, or tribal government to 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
regulate a lawful activity of a non- 
Federal entity. 
‘‘(8) LIABILITY EXEMPTIONS.— 
‘‘(A) NETWORK AWARENESS.—No cause of 
action shall lie or be maintained in any court, 
and such action shall be promptly dismissed, 
against any non-Federal entity that, for cyber-
security purposes, conducts network awareness 
under paragraph (4), if such network awareness 
is conducted in accordance with such paragraph 
and this section. 
‘‘(B) INFORMATION
SHARING.—No cause 
of action shall lie or be maintained in any 
court, and such action shall be promptly dis-
missed, against any non-Federal entity that, for 
cybersecurity purposes, shares cyber threat in-
dicators or defensive measures under paragraph 
(3), or in good faith fails to act based on such 
sharing, if such sharing is conducted in accord-
ance with such paragraph and this section. 
‘‘(C) WILLFUL MISCONDUCT.— 
‘‘(i) RULE OF CONSTRUCTION.—Noth-
ing in this section may be construed to— 
‘‘(I) require dismissal of a cause 
of action against a non-Federal entity 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
that has engaged in willful misconduct 
in the course of conducting activities 
authorized by this section; or 
‘‘(II) undermine or limit the 
availability of otherwise applicable 
common law or statutory defenses. 
‘‘(ii) 
PROOF
OF
WILLFUL
MIS-
CONDUCT.—In any action claiming that 
subparagraph (A) or (B) does not apply 
due to willful misconduct described in 
clause (i), the plaintiff shall have the bur-
den of proving by clear and convincing evi-
dence the willful misconduct by each non- 
Federal entity subject to such claim and 
that such willful misconduct proximately 
caused injury to the plaintiff. 
‘‘(iii) 
WILLFUL
MISCONDUCT
DE-
FINED.—In this subsection, the term ‘will-
ful misconduct’ means an act or omission 
that is taken— 
‘‘(I) intentionally to achieve a 
wrongful purpose; 
‘‘(II) knowingly without legal or 
factual justification; and 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
‘‘(III) in disregard of a known or 
obvious risk that is so great as to 
make it highly probable that the harm 
will outweigh the benefit. 
‘‘(D) EXCLUSION.—The term ‘non-Federal 
entity’ as used in this paragraph shall not in-
clude a State, local, or tribal government. 
‘‘(9) FEDERAL
GOVERNMENT
LIABILITY
FOR 
VIOLATIONS
OF
RESTRICTIONS
ON
THE
USE
AND 
PROTECTION
OF
VOLUNTARILY
SHARED
INFORMA-
TION.— 
‘‘(A) IN
GENERAL.—If a department or 
agency of the Federal Government intentionally 
or willfully violates the restrictions specified in 
paragraph (3), (6), or (7)(B) on the use and 
protection of voluntarily shared cyber threat in-
dicators or defensive measures, or any other 
provision of this section, the Federal Govern-
ment shall be liable to a person injured by such 
violation in an amount equal to the sum of— 
‘‘(i) the actual damages sustained by 
such person as a result of such violation or 
$1,000, whichever is greater; and 
‘‘(ii) reasonable attorney fees as deter-
mined by the court and other litigation 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
costs reasonably occurred in any case 
under this subsection in which the com-
plainant has substantially prevailed. 
‘‘(B) VENUE.—An action to enforce liabil-
ity under this subsection may be brought in the 
district court of the United States in— 
‘‘(i) the district in which the com-
plainant resides; 
‘‘(ii) the district in which the principal 
place of business of the complainant is lo-
cated; 
‘‘(iii) the district in which the depart-
ment or agency of the Federal Government 
that disclosed the information is located; or 
‘‘(iv) the District of Columbia. 
‘‘(C) STATUTE OF LIMITATIONS.—No ac-
tion shall lie under this subsection unless such 
action is commenced not later than two years 
after the date on which the cause of action 
arises. 
‘‘(D) EXCLUSIVE
CAUSE
OF
ACTION.—A 
cause of action under this subsection shall be 
the exclusive means available to a complainant 
seeking a remedy for a violation of any restric-
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS
HR 1560 RDS
tion specified in paragraph (3), (6), or 7(B) or 
any other provision of this section. 
‘‘(10) ANTI-TRUST EXEMPTION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (C), it shall not be considered a 
violation of any provision of antitrust laws for 
two or more non-Federal entities to share a 
cyber threat indicator or defensive measure, or 
assistance relating to the prevention, investiga-
tion, or mitigation of a cybersecurity risk or in-
cident, for cybersecurity purposes under this 
Act. 
‘‘(B) APPLICABILITY.—Subparagraph (A) 
shall apply only to information that is shared or 
assistance that is provided in order to assist 
with— 
‘‘(i) facilitating the prevention, inves-
tigation, or mitigation of a cybersecurity 
risk or incident to an information system 
or information that is stored on, processed 
by, or transiting an information system; or 
‘‘(ii) communicating or disclosing a 
cyber threat indicator or defensive measure 
to help prevent, investigate, or mitigate the 
effect of a cybersecurity risk or incident to 
VerDate Sep 11 2014 
23:33 Apr 30, 2015
Jkt 049200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RDS
H1560
emcdonald on DSK67QTVN1PROD with BILLS