conducted in accordance with such paragraph 
and this section. 
‘‘(C) WILLFUL MISCONDUCT.— 
‘‘(i) RULE OF CONSTRUCTION.—Noth-
ing in this section may be construed to— 
‘‘(I) require dismissal of a cause 
of action against a non-Federal entity 
that has engaged in willful misconduct 
in the course of conducting activities 
authorized by this section; or 
‘‘(II) undermine or limit the 
availability of otherwise applicable 
common law or statutory defenses. 
‘‘(ii) 
PROOF
OF
WILLFUL
MIS-
CONDUCT.—In any action claiming that 
subparagraph (A) or (B) does not apply due 
to willful misconduct described in clause (i), 
the plaintiff shall have the burden of prov-
ing by clear and convincing evidence the 
willful misconduct by each non-Federal en-
tity subject to such claim and that such 
willful misconduct proximately caused in-
jury to the plaintiff. 
‘‘(iii) 
WILLFUL
MISCONDUCT
DE-
FINED.—In this subsection, the term ‘willful 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
misconduct’ means an act or omission that 
is taken— 
‘‘(I) intentionally to achieve a 
wrongful purpose; 
‘‘(II) knowingly without legal or 
factual justification; and 
‘‘(III) in disregard of a known or 
obvious risk that is so great as to make 
it highly probable that the harm will 
outweigh the benefit. 
‘‘(D) EXCLUSION.—The term ‘non-Federal 
entity’ as used in this paragraph shall not in-
clude a State, local, or tribal government. 
‘‘(9) FEDERAL GOVERNMENT LIABILITY FOR VIO-
LATIONS OF RESTRICTIONS ON THE USE AND PROTEC-
TION OF VOLUNTARILY SHARED INFORMATION.— 
‘‘(A) IN
GENERAL.—If a department or 
agency of the Federal Government intentionally 
or willfully violates the restrictions specified in 
paragraph (3), (6), or (7)(B) on the use and pro-
tection of voluntarily shared cyber threat indica-
tors or defensive measures, or any other provi-
sion of this section, the Federal Government shall 
be liable to a person injured by such violation in 
an amount equal to the sum of— 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(i) the actual damages sustained by 
such person as a result of such violation or 
$1,000, whichever is greater; and 
‘‘(ii) reasonable attorney fees as deter-
mined by the court and other litigation 
costs reasonably occurred in any case under 
this subsection in which the complainant 
has substantially prevailed. 
‘‘(B) VENUE.—An action to enforce liability 
under this subsection may be brought in the dis-
trict court of the United States in— 
‘‘(i) the district in which the complain-
ant resides; 
‘‘(ii) the district in which the prin-
cipal place of business of the complainant is 
located; 
‘‘(iii) the district in which the depart-
ment or agency of the Federal Government 
that disclosed the information is located; or 
‘‘(iv) the District of Columbia. 
‘‘(C) STATUTE OF LIMITATIONS.—No action 
shall lie under this subsection unless such action 
is commenced not later than two years after the 
date of the violation of any restriction specified 
in paragraph (3), (6), or 7(B), or any other pro-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
vision of this section, that is the basis for such 
action. 
‘‘(D) EXCLUSIVE
CAUSE
OF
ACTION.—A 
cause of action under this subsection shall be the 
exclusive means available to a complainant seek-
ing a remedy for a violation of any restriction 
specified in paragraph (3), (6), or 7(B) or any 
other provision of this section. 
‘‘(10) ANTI-TRUST EXEMPTION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (C), it shall not be considered a 
violation of any provision of antitrust laws for 
two or more non-Federal entities to share a cyber 
threat indicator or defensive measure, or assist-
ance relating to the prevention, investigation, or 
mitigation of a cybersecurity risk or incident, for 
cybersecurity purposes under this Act. 
‘‘(B) APPLICABILITY.—Subparagraph (A) 
shall apply only to information that is shared or 
assistance that is provided in order to assist 
with— 
‘‘(i) facilitating the prevention, inves-
tigation, or mitigation of a cybersecurity 
risk or incident to an information system 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
or information that is stored on, processed 
by, or transiting an information system; or 
‘‘(ii) communicating or disclosing a 
cyber threat indicator or defensive measure 
to help prevent, investigate, or mitigate the 
effect of a cybersecurity risk or incident to 
an information system or information that 
is stored on, processed by, or transiting an 
information system. 
‘‘(C) PROHIBITED
CONDUCT.—Nothing in 
this section may be construed to permit price-fix-
ing, allocating a market between competitors, 
monopolizing or attempting to monopolize a 
market, or exchanges of price or cost informa-
tion, customer lists, or information regarding fu-
ture competitive planning. 
‘‘(11) CONSTRUCTION AND PREEMPTION.— 
‘‘(A) OTHERWISE LAWFUL DISCLOSURES.— 
Nothing in this section may be construed to limit 
or prohibit otherwise lawful disclosures of com-
munications, records, or other information, in-
cluding reporting of known or suspected criminal 
activity or participating voluntarily or under 
legal requirement in an investigation, by a non- 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
Federal to any other non-Federal entity or Fed-
eral entity under this section. 
‘‘(B) WHISTLE
BLOWER
PROTECTIONS.— 
Nothing in this section may be construed to pro-
hibit or limit the disclosure of information pro-
tected under section 2302(b)(8) of title 5, United 
States Code (governing disclosures of illegality, 
waste, fraud, abuse, or public health or safety 
threats), section 7211 of title 5, United States 
Code (governing disclosures to Congress), section 
1034 of title 10, United States Code (governing 
disclosure to Congress by members of the mili-
tary), section 1104 of the National Security Act 
of 1947 (50 U.S.C. 3234) (governing disclosure 
by employees of elements of the intelligence com-
munity), or any similar provision of Federal or 
State law. 
‘‘(C) RELATIONSHIP
TO
OTHER
LAWS.— 
Nothing in this section may be construed to af-
fect any requirement under any other provision 
of law for a non-Federal entity to provide infor-
mation to a Federal entity. 
‘‘(D) PRESERVATION OF CONTRACTUAL OB-
LIGATIONS AND RIGHTS.—Nothing in this section 
may be construed to— 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
to subject any non-Federal entity to liability for 
choosing to not engage in the voluntary activities 
authorized under this section. 
‘‘(G) USE
AND
RETENTION
OF
INFORMA-
TION.—Nothing in this section may be construed 
to authorize, or to modify any existing authority 
of, a department or agency of the Federal Gov-
ernment to retain or use any information shared 
under this section for any use other than per-
mitted in this section. 
‘‘(H) VOLUNTARY
SHARING.—Nothing in 
this section may be construed to restrict or con-
dition a non-Federal entity from sharing, for cy-
bersecurity purposes, cyber threat indicators, de-
fensive measures, or information related to cy-
bersecurity risks or incidents with any other 
non-Federal entity, and nothing in this section 
may be construed as requiring any non-Federal 
entity to share cyber threat indicators, defensive 
measures, or information related to cybersecurity 
risks or incidents with the Center. 
‘‘(I) FEDERAL PREEMPTION.—This section 
supersedes any statute or other provision of law 
of a State or political subdivision of a State that 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
restricts or otherwise expressly regulates an ac-
tivity authorized under this section. 
‘‘(j) DIRECT REPORTING.—The Secretary shall develop 
policies and procedures for direct reporting to the Secretary 
by the Director of the Center regarding significant cyberse-
curity risks and incidents. 
‘‘(k) ADDITIONAL RESPONSIBILITIES.—The Secretary 
shall build upon existing mechanisms to promote a national 
awareness effort to educate the general public on the impor-
tance of securing information systems. 
‘‘(l) REPORTS ON INTERNATIONAL COOPERATION.— 
Not later than 180 days after the date of the enactment of 
this subsection and periodically thereafter, the Secretary of 
Homeland Security shall submit to the Committee on 
Homeland Security of the House of Representatives and the 
Committee on Homeland Security and Governmental Af-
fairs of the Senate a report on the range of efforts underway 
to bolster cybersecurity collaboration with relevant inter-
national partners in accordance with subsection (c)(8). 
‘‘(m) OUTREACH.—Not later than 60 days after the 
date of the enactment of this subsection, the Secretary, act-
ing through the Under Secretary for Cybersecurity and In-
frastructure Protection, shall— 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
‘‘(1) disseminate to the public information about 
how to voluntarily share cyber threat indicators and 
defensive measures with the Center; and 
‘‘(2) enhance outreach to critical infrastructure 
owners and operators for purposes of such sharing.’’. 
SEC. 4. INFORMATION SHARING AND ANALYSIS ORGANIZA-
TIONS. 
Section 212 of the Homeland Security Act of 2002 (6 
U.S.C. 131) is amended— 
(1) in paragraph (5)— 
(A) in subparagraph (A)— 
(i) by inserting ‘‘information related to 
cybersecurity risks and incidents and’’ after 
‘‘critical infrastructure information’’; and 
(ii) by striking ‘‘related to critical in-
frastructure’’ and inserting ‘‘related to cy-
bersecurity risks, incidents, critical infra-
structure, and’’; 
(B) in subparagraph (B)— 
(i) by striking ‘‘disclosing critical in-
frastructure information’’ and inserting 
‘‘disclosing cybersecurity risks, incidents, 
and critical infrastructure information’’; 
and 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
(ii) by striking ‘‘related to critical in-
frastructure or’’ and inserting ‘‘related to 
cybersecurity risks, incidents, critical infra-
structure, or’’ and 
(C) in subparagraph (C), by striking ‘‘dis-
seminating critical infrastructure information’’ 
and inserting ‘‘disseminating cybersecurity risks, 
incidents, and critical infrastructure informa-
tion’’; and 
(2) by adding at the end the following new para-
graph: 
‘‘(8) CYBERSECURITY
RISK; 
INCIDENT.—The 
terms ‘cybersecurity risk’ and ‘incident’ have the 
meanings given such terms in the second section 226 
(relating to the National Cybersecurity and Commu-
nications Integration Center).’’. 
SEC. 5. STREAMLINING OF DEPARTMENT OF HOMELAND SE-
CURITY CYBERSECURITY AND INFRASTRUC-
TURE PROTECTION ORGANIZATION. 
(a) CYBERSECURITY AND INFRASTRUCTURE PROTEC-
TION.—The National Protection and Programs Directorate 
of the Department of Homeland Security shall, after the 
date of the enactment of this Act, be known and designated 
as the ‘‘Cybersecurity and Infrastructure Protection’’. Any 
reference to the National Protection and Programs Direc-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
torate of the Department in any law, regulation, map, doc-
ument, record, or other paper of the United States shall be 
deemed to be a reference to the Cybersecurity and Infra-
structure Protection of the Department. 
(b) SENIOR LEADERSHIP OF CYBERSECURITY AND IN-
FRASTRUCTURE PROTECTION.— 
(1) IN GENERAL.—Subsection (a) of section 103 
of the Homeland Security Act of 2002 (6 U.S.C. 113) 
is amended— 
(A) in paragraph (1)— 
(i) by amending subparagraph (H) to 
read as follows: 
‘‘(H) An Under Secretary for Cybersecurity 
and Infrastructure Protection.’’; and 
(ii) by adding at the end the following 
new subparagraphs: 
‘‘(K) A Deputy Under Secretary for Cyber-
security. 
‘‘(L) A Deputy Under Secretary for Infra-
structure Protection.’’; and 
(B) by adding at the end the following new 
paragraph: 
‘‘(3) DEPUTY UNDER SECRETARIES.—The Dep-
uty Under Secretaries referred to in subparagraphs 
(K) and (L) of paragraph (1) shall be appointed by 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
the President without the advice and consent of the 
Senate.’’. 
(2) CONTINUATION IN OFFICE.—The individuals 
who hold the positions referred in subparagraphs (H), 
(K), and (L) of paragraph (1) of section 103(a) the 
Homeland Security Act of 2002 (as amended and 
added by paragraph (1) of this subsection) as of the 
date of the enactment of this Act may continue to 
hold such positions. 
(c) REPORT.—Not later than 90 days after the date 
of the enactment of this Act, the Under Secretary for Cyber-
security and Infrastructure Protection of the Department 
of Homeland Security shall submit to the Committee on 
Homeland Security of the House of Representatives and the 
Committee on Homeland Security and Governmental Af-
fairs of the Senate a report on the feasibility of becoming 
an operational component, including an analysis of alter-
natives, and if a determination is rendered that becoming 
an operational component is the best option for achieving 
the mission of Cybersecurity and Infrastructure Protection, 
a legislative proposal and implementation plan for becom-
ing such an operational component. Such report shall also 
include plans to more effectively carry out the cybersecurity 
mission of Cybersecurity and Infrastructure Protection, in-
cluding expediting information sharing agreements. 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS