H. R. 2471—976 
(3) STANDARDS.—The intelligence assessment under para-
graph (1) shall be conducted in a manner that meets the ana-
lytic integrity and tradecraft standards of the intelligence 
community. 
(4) FORM.—The intelligence assessment under paragraph 
(1) shall be submitted in unclassified form, but may include 
a classified annex in electronic form that is fully indexed and 
searchable. In carrying out this paragraph, the officials respon-
sible for submitting such assessment shall ensure that the 
assessment is unclassified to the extent practicable. 
(b) REPORT.— 
(1) REQUIREMENT.—Not later than 150 days after the date 
of the enactment of this Act, the Director of National Intel-
ligence, acting through the Director of the National Counterter-
rorism Center, in coordination with the Secretary of State, 
the Secretary of the Treasury, the Attorney General, the Sec-
retary of Homeland Security, and in a manner consistent with 
the authorities and responsibilities of such Secretary or 
Director, shall submit to the appropriate congressional commit-
tees a report on the use of Federal laws, regulations, and 
policies by the Federal Government to counter significant 
threats to the United States and United States persons associ-
ated with foreign racially motivated violent extremist organiza-
tions. 
(2) ELEMENTS.—The report under paragraph (1) shall 
include the following: 
(A) An identification, description, and assessment of 
the use and efficacy of, Federal laws, regulations, and 
policies used by the Federal Government to address signifi-
cant threats to the United States and United States persons 
associated with foreign racially motivated violent extremist 
organizations, including pursuant to— 
(i) section 1016 of the Intelligence Reform and 
Terrorism Prevention Act of 2004 (6 U.S.C. 485) and 
section 119 of the National Security Act of 1949 (50 
U.S.C. 3056), particularly with respect to the coordina-
tion and integration of all instruments of national 
power; 
(ii) Executive Order 12333 (50 U.S.C. 3001 note), 
as amended; 
(iii) the designation of foreign terrorist organiza-
tions under section 219 of the Immigration and Nation-
ality Act (8 U.S.C. 1189); 
(iv) the designation of specially designated terror-
ists, specially designated global terrorists, or specially 
designated nationals and blocked persons, pursuant 
to Executive Orders 13886, 13372, and 13224 and parts 
594, 595, 596, and 597 of title 31, Code of Federal 
Regulations; 
(v) National Security Presidential Memorandums 
7 and 9, particularly with respect to the sharing of 
terrorism information and screening and vetting activi-
ties; and 
(vi) any other applicable Federal laws, regulations, 
or policies.
H. R. 2471—977 
(B) An assessment of whether (and if so, to what 
extent and why) such Federal laws, regulations, and poli-
cies are sufficient to counter such threats, including a 
description of any gaps and specific examples to illustrate 
such gaps. 
(C) Recommendations regarding how to remedy the 
gaps under subparagraph (B). 
(3) PRIVACY AND CIVIL LIBERTIES ASSESSMENT.—Not later 
than 180 days after the date of the enactment of this Act, 
the Privacy and Civil Liberties Oversight Board, in consultation 
with the civil liberties and privacy officers of the Federal depart-
ments and agencies the Board determines appropriate, shall 
submit to the appropriate congressional committees a report 
containing— 
(A) an assessment of the impacts on the privacy and 
civil liberties of United States persons concerning the use 
or recommended use of any Federal laws, regulations, and 
policies specified in paragraph (2); and 
(B) recommendations on options to develop protections 
to mitigate such impacts. 
(4) FORM.—The report under paragraph (1) shall be sub-
mitted in unclassified form, but may include a classified annex 
in electronic form that is fully indexed and searchable. In 
carrying out this paragraph, the officials responsible for submit-
ting such report shall ensure that the report is unclassified 
to the extent practicable. 
(5) SEPARATE SUBMISSION.—The Director shall submit to 
the appropriate congressional committees the report under 
paragraph (1) as a separate report from the report submitted 
under section 826(a)(2). 
(c) DEFINITIONS.—In this section: 
(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term 
‘‘appropriate congressional committees’’ means— 
(A) the congressional intelligence committees; 
(B) the Subcommittees on Financial Services and Gen-
eral Government, the Subcommittees on Homeland Secu-
rity, and the Subcommittees on State, Foreign Operations, 
and Related Programs of the Committees on Appropriations 
of the House of Representatives and the Senate; and 
(C) the Committee on Foreign Affairs of the House 
of Representatives and the Committee on Foreign Relations 
of the Senate. 
(2) 
TERRORISM
INFORMATION.—The 
term 
‘‘terrorism 
information’’ has the meaning given that term in section 1016(a) 
of the Intelligence Reform and Terrorism Prevention Act of 
2004 (6 U.S.C. 485(a)). 
(3) UNITED STATES PERSON.—The term ‘‘United States per-
son’’ has the meaning given that term in section 105A(c) of 
the National Security Act of 1947 (50 U.S.C. 3039). 
SEC. 825. NATIONAL INTELLIGENCE ESTIMATE ON ESCALATION AND 
DE-ESCALATION OF GRAY ZONE ACTIVITIES IN GREAT 
POWER COMPETITION. 
(a) FINDINGS.—Congress finds the following: 
(1) The conventional power of the United States has driven 
foreign adversaries to a level of competition that does not 
always depend on military confrontation with the United States.
H. R. 2471—978 
(2) Rather than challenging the United States in a manner 
that could provoke a kinetic military response, foreign adver-
saries of the United States have turned to carrying out gray 
zone activities to advance the interests of such adversaries, 
weaken the power of the United States, and erode the norms 
that underpin the United States-led international order. 
(3) Gray zone activity falls on a spectrum of attribution 
and deniability that ranges from covert adversary operations, 
to detectible covert adversary operations, to unattributable 
adversary operations, to deniable adversary operations, to open 
adversary operations. 
(4) To adequately address such a shift to gray zone activity, 
the United States must understand what actions tend to either 
escalate or de-escalate such activity by its adversaries. 
(5) The laws, principles, and values of the United States 
are strategic advantages in great power competition with 
authoritarian foreign adversaries that carry out gray zone 
activities, because such laws, principles, and values increase 
the appeal of the governance model of the United States, and 
the United States-led international order, to states and peoples 
around the world. 
(6) The international security environment has dem-
onstrated numerous examples of gray zone activities carried 
out by foreign adversaries, including the following activities 
of foreign adversaries: 
(A) Information operations, such as efforts by Russia 
to influence the 2020 United States Federal elections (as 
described in the March 15, 2021, intelligence community 
assessment of the Office of the Director of National Intel-
ligence made publicly available on March 15, 2021). 
(B) Adversary political coercion operations, such as 
the wielding of energy by Russia, particularly in the context 
of Ukrainian gas pipelines, to coerce its neighbors into 
compliance with its policies. 
(C) Adversary economic coercion operations, such as 
the threat, and use, by China of economic retaliation to 
coerce sovereign countries into compliance with its policies 
or to blunt any criticism of its violations of the rules- 
based international order and its perpetration of severe 
human rights abuses. 
(D) Cyber operations, such as the use by China of 
cyber tools to conduct industrial espionage. 
(E) Provision of support to proxy forces, such as the 
support provided by Iran to Hezbollah and Shia militia 
groups. 
(F) Provocation by armed forces controlled by the 
government of the foreign adversary through measures that 
do not rise to the level of an armed attack, such as the 
use of the China Coast Guard and maritime militia by 
China to harass the fishing vessels of other countries in 
the South China Sea. 
(G) Alleged uses of lethal force on foreign soil, such 
as the 2018 poisoning of Sergei Skripal in London by 
Russia. 
(H) The potential use by an adversary of technology 
that causes anomalous health incidents among United 
States Government personnel.
H. R. 2471—979 
(b) NATIONAL INTELLIGENCE ESTIMATE.— 
(1) REQUIREMENT.—The Director of National Intelligence, 
acting through the National Intelligence Council, shall produce 
a National Intelligence Estimate on how foreign adversaries 
use gray zone activities to advance interests, what responses 
by the United States (or the allies or partners of the United 
States) would tend to result in the escalation or de-escalation 
of such gray zone activities by foreign adversaries, and any 
opportunities for the United States to minimize the extent 
to which foreign adversaries use gray zone activities in further-
ance of great power competition. 
(2) MATTERS INCLUDED.—To the extent determined appro-
priate by the National Intelligence Council, the National Intel-
ligence Estimate produced under paragraph (1) may include 
an assessment of the following topics: 
(A) Any potential or actual lethal or harmful gray 
zone activities carried out against the United States by 
foreign adversaries, including against United States 
Government employees and United States persons, whether 
located within or outside of the United States. 
(B) To the extent such activities have occurred, or 
are predicted to occur— 
(i) opportunities to reduce or deter any such activi-
ties; and 
(ii) any actions of the United States Government 
that would tend to result in the escalation or de-esca-
lation of such activities. 
(C) Any incidents in which foreign adversaries could 
have used, but ultimately did not use, gray zone activities 
to advance the interests of such adversaries, including an 
assessment as to why the foreign adversary ultimately 
did not use gray zone activities. 
(D) The effect of lowering the United States Govern-
ment threshold for the public attribution of detectible covert 
adversary operations, unattributable adversary operations, 
and deniable adversary operations. 
(E) The effect of lowering the United States Govern-
ment threshold for responding to detectible covert 
adversary operations, unattributable adversary operations, 
and deniable adversary operations. 
(F) The extent to which the governments of foreign 
adversaries exercise control over any proxies or parastate 
actors used by such governments in carrying out gray 
zone activities. 
(G) The extent to which gray zone activities carried 
out by foreign adversaries affect the private sector of the 
United States. 
(H) The international norms that provide the greatest 
deterrence to gray zone activities carried out by foreign 
adversaries, and opportunities for strengthening those 
norms. 
(I) The effect, if any, of the strengthening of democratic 
governance abroad on the resilience of United States allies 
and partners to gray zone activities. 
(J) Opportunities to strengthen the resilience of United 
States allies and partners to gray zone activities, and asso-
ciated tactics, carried out by foreign adversaries.
H. R. 2471—980 
(K) Opportunities for the United States to improve 
the detection of, and early warning for, such activities 
and tactics. 
(L) Opportunities for the United States to galvanize 
international support in responding to such activities and 
tactics. 
(3) SUBMISSION TO CONGRESS.— 
(A) SUBMISSION.—Not later than 1 year after the date 
of the enactment of this Act, the Director shall submit 
to the congressional intelligence committees and the 
Committees on Armed Services of the House of Representa-
tives and the Senate the National Intelligence Estimate 
produced under paragraph (1). In so submitting the Esti-
mate to the congressional intelligence committees, the 
Director shall include all intelligence reporting underlying 
the Estimate. 
(B) NOTICE REGARDING SUBMISSION.—If at any time 
before the deadline specified in subparagraph (A), the 
Director determines that the National Intelligence Esti-
mate produced under paragraph (1) cannot be submitted 
by such deadline, the Director shall (before such deadline) 
submit to the committees specified in subparagraph (A) 
a report setting forth the reasons why the National Intel-
ligence Estimate cannot be submitted by such deadline 
and an estimated date for the submission of the National 
Intelligence Estimate. 
(C) FORM.—Any report under subparagraph (B) shall 
be submitted in unclassified form. 
(4) PUBLIC
VERSION.—Consistent with the protection of 
intelligence sources and methods, at the same time as the 
Director submits to the congressional intelligence committees 
and the Committees on Armed Services of the House of Rep-
resentatives and the Senate the National Intelligence Estimate 
under paragraph (1), the Director shall make publicly available 
on the internet website of the Director an unclassified version 
of the key findings of the National Intelligence Estimate. 
(5) DEFINITIONS.—In this subsection: 
(A) GRAY
ZONE
ACTIVITY.—The term ‘‘gray zone 
activity’’ means an activity to advance the national 
interests of a State that— 
(i) falls between ordinary statecraft and open war-
fare; 
(ii) is carried out with an intent to maximize the 
advancement of interests of the state without pro-
voking a kinetic military response by the United 
States; and 
(iii) falls on a spectrum that ranges from covert 
adversary operations, to detectible covert adversary 
operations, to unattributable adversary operations, to 
deniable adversary operations, to open adversary oper-
ations. 
(B) COVERT ADVERSARY OPERATION.—The term ‘‘covert 
adversary operation’’ means an operation by an adversary 
that— 
(i) the adversary intends to remain below the 
threshold at which the United States detects the oper-
ation; and
H. R. 2471—982 
groups, in domestic violent extremist activities in the United 
States; and 
(2) submit to the appropriate congressional committees a 
report containing the findings of the Director with respect 
to the assessment. 
(b) FORM.—The report under subsection (a)(2) shall be sub-
mitted in unclassified form, but may include a classified annex. 
(c) SEPARATE SUBMISSION.—The Director shall submit to the 
appropriate congressional committees the report under subsection 
(a)(2) as a separate report from the report submitted under section 
824(b)(1). 
(d) APPROPRIATE CONGRESSIONAL COMMITTEES DEFINED.—In 
this section, the term ‘‘appropriate congressional committees’’ 
means— 
(1) the congressional intelligence committees; 
(2) the Committee on Foreign Relations and the Committee 
on the Judiciary of the Senate; and 
(3) the Committee on Foreign Affairs and the Committee 
on the Judiciary of the House of Representatives. 
SEC. 827. REPORT ON POTENTIAL INCLUSION WITHIN INTELLIGENCE 
COMMUNITY OF THE OFFICE OF NATIONAL SECURITY OF 
THE DEPARTMENT OF HEALTH AND HUMAN SERVICES. 
(a) REPORT.—Not later than 180 days after the date of the 
enactment of this Act, the Director of National Intelligence, in 
coordination with the Secretary of Health and Human Services, 
shall submit to the appropriate congressional committees a report 
on the potential advantages and disadvantages of adding the Office 
of National Security of the Department of Health and Human 
Services as a new element of the intelligence community. 
(b) MATTERS INCLUDED.—The report under subsection (a) shall 
include the following: 
(1) An assessment of the following: 
(A) The likelihood that the addition of the Office of 
National Security as a new element of the intelligence 
community would increase connectivity between other ele-
ments of the intelligence community working on health 
security topics and the Department of Health and Human 
Services. 
(B) The likelihood that such addition would increase 
the flow of raw intelligence and finished intelligence prod-
ucts to officials of the Department of Health and Human 
Services. 
(C) The likelihood that such addition would facilitate 
the flow of information relating to health security topics 
to intelligence analysts of various other elements of the 
intelligence community working on such topics. 
(D) The extent to which such addition would clearly 
demonstrate to both the national security community and 
the public health community that health security is 
national security. 
(E) Any anticipated impediments to such addition 
relating to additional budgetary oversight by the executive 
branch or Congress. 
(F) Any other significant advantages or disadvantages 
of such addition, as identified by either the Director of
H. R. 2471—983 
National Intelligence or the Secretary of Health and 
Human Services. 
(2) A joint recommendation by the Director of National 
Intelligence and the Secretary of Health and Human Services 
as to whether to add the Office of National Security as a 
new element of the intelligence community. 
(c) FORM.—The report under subsection (a) shall be submitted 
in unclassified form, but may include a classified annex. 
(d) APPROPRIATE CONGRESSIONAL COMMITTEES DEFINED.—In 
this section, the term ‘‘appropriate congressional committees’’ 
means— 
(1) the congressional intelligence committees; 
(2) the Committee on Energy and Commerce of the House 
of Representatives and the Committee on Health, Education, 
Labor, and Pensions of the Senate; and 
(3) the Subcommittees on Labor, Health and Human Serv-
ices, Education, and Related Agencies of the Committees on 
Appropriations of the House of Representatives and the Senate. 
SEC. 828. REPORT ON EFFORTS TO BUILD AN INTEGRATED HYBRID 
SPACE ARCHITECTURE. 
(a) REPORT REQUIRED.—Not later than 180 days after the date 
of the enactment of this Act, and annually for 2 years thereafter, 
the Director of National Intelligence, in coordination with the Under 
Secretary of Defense for Intelligence and Security and the Director 
of the National Reconnaissance Office, shall submit to the appro-
priate congressional committees a report on the efforts of the intel-
ligence community to build an integrated hybrid space architecture 
that combines national and commercial capabilities and large and 
small satellites. 
(b) ELEMENTS.—The report required by subsection (a) shall 
include the following: 
(1) An assessment of how the integrated hybrid space 
architecture approach is being realized in the overhead architec-
ture of the National Reconnaissance Office. 
(2) An assessment of the benefits to the mission of the 
National Reconnaissance Office and the cost of integrating 
capabilities from smaller, proliferated satellites and data from 
commercial satellites with the national technical means 
architecture. 
(c) APPROPRIATE CONGRESSIONAL COMMITTEES DEFINED.—In 
this section, the term ‘‘appropriate congressional committees’’ 
means— 
(1) the congressional intelligence committees; and 
(2) the congressional defense committees. 
SEC. 829. REPORT ON CERTAIN ACTIONS TAKEN BY INTELLIGENCE 
COMMUNITY WITH RESPECT TO HUMAN RIGHTS AND 
INTERNATIONAL HUMANITARIAN LAW. 
(a) REPORT.—Not later than 120 days after the date of the 
enactment of this Act, the Director of National Intelligence, in 
coordination with the Director of the Central Intelligence Agency, 
the Director of the National Security Agency, the Secretary of 
Defense, and the Director of the Defense Intelligence Agency, and 
consistent with the protection of intelligence sources and methods, 
shall submit to the appropriate congressional committees a report 
on certain actions taken by the intelligence community with respect 
to human rights and international humanitarian law.
H. R. 2471—984 
(b) ELEMENTS.—The report under subsection (a) shall include 
the following: 
(1) A detailed explanation of whether, and to what extent, 
each element of the intelligence community has provided intel-
ligence products relating to the efforts of the Secretary of State 
and the Secretary of Treasury regarding the categorization, 
determinations on eligibility for assistance and training, and 
general understanding, of covered entities that commit, engage, 
or are otherwise complicit in, violations of human rights or 
international humanitarian law. 
(2) A detailed explanation of whether, and to what extent, 
each element of the intelligence community has provided intel-
ligence products relating to any of the following: 
(A) Section 7031(c) of the Department of State, Foreign 
Operations, and Related Programs Appropriations Act, 
2020 (division G of Public Law 116–94; 8 U.S.C. 1182 
note). 
(B) The visa restriction policy of the Department of 
State announced on February 26, 2021, and commonly 
referred to as the ‘‘Khashoggi Ban’’. 
(C) The annual report requirement of the Department 
of Defense under section 1057 of the National Defense 
Authorization Act for Fiscal Year 2018 (131 Stat. 1572). 
(D) The Global Magnitsky Human Rights Account-
ability Act (subtitle F of title XII of Public Law 114– 
328; 22 U.S.C. 2656 note). 
(3) A detailed explanation of the following processes: 
(A) The process of each element of the intelligence 
community for monitoring covered entities for derogatory 
human rights or international humanitarian law informa-
tion. 
(B) The process of each element of the intelligence 
community for determining the credibility of derogatory 
human rights or international humanitarian law informa-
tion. 
(C) The process of each element of the intelligence 
community for determining what further action is appro-
priate if derogatory human rights or international humani-
tarian law information is determined to be credible. 
(4) An unredacted copy of each policy or similar document 
that describes a process specified in paragraph (3). 
(5) A detailed explanation of whether, with respect to each 
element of the intelligence community, the head of the element 
has changed or restricted any activities of the element in 
response to derogatory human rights or international humani-
tarian law information. 
(6) Examples of any changes or restrictions specified in 
paragraph (5) taken by the head of the element of the intel-
ligence community during the two years preceding the date 
of the submission of the report. 
(c) FORM.—The report under subsection (a) shall be submitted 
in unclassified form, but may include a classified annex. 
(d) DEFINITIONS.—In this section: 
(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term 
‘‘appropriate congressional committees’’ means— 
(A) the congressional intelligence committees;
H. R. 2471—985 
(B) the Committee on Armed Services and the Com-
mittee on Foreign Affairs of the House of Representatives; 
(C) the Committee on Armed Services and the Com-
mittee on Foreign Relations of the Senate; and 
(D) the Subcommittees on Financial Services and Gen-
eral Government and the Subcommittees on State, Foreign 
Operations, and Related Programs of the Committees on 
Appropriations of the House of Representatives and the 
Senate. 
(2) COVERED ENTITY.—The term ‘‘covered entity’’— 
(A) means an individual, unit, or foreign government 
that— 
(i) has a cooperative relationship with the United 
States Government; or 
(ii) is the target of an intelligence collection activity 
carried out by the United States Government; but 
(B) does not include an employee of the United States 
Government. 
(3) DEROGATORY HUMAN RIGHTS OR INTERNATIONAL HUMANI-
TARIAN LAW INFORMATION.—The term ‘‘derogatory human rights 
or international humanitarian law information’’ means informa-
tion tending to suggest that a covered entity committed, partici-
pated, or was otherwise complicit in, a violation of human 
rights or international humanitarian law, regardless of the 
credibility of such information, the source of the information, 
or the level of classification of the information. 
(4) VIOLATION
OF
HUMAN
RIGHTS
OR
INTERNATIONAL 
HUMANITARIAN LAW.—The term ‘‘violation of human rights or 
international humanitarian law’’ includes a violation of any 
authority or obligation of the United States Government related 
to human rights or international humanitarian law, without 
regard to whether such authority or obligation is codified in 
a provision of law, regulation, or policy. 
SEC. 830. REPORT ON RARE EARTH ELEMENTS. 
(a) REPORT.—Not later than 180 days after the date of the 
enactment of this Act, the Director of National Intelligence, in 
coordination with the Director of the Defense Intelligence Agency, 
the Director of the Office of Intelligence and Counterintelligence 
of the Department of Energy, and any other head of an element 
of the intelligence community that the Director of National Intel-
ligence determines relevant, shall submit to the congressional intel-
ligence committees a report on rare earth elements. 
(b) MATTERS INCLUDED.—The report under subsection (a) shall 
include the following: 
(1) An assessment coordinated by the National Intelligence 
Council of— 
(A) long-term trends in the global rare earth element 
industry; 
(B) the national security, economic, and industrial risks 
to the United States, and to the partners and allies of 
the United States, with respect to relying on foreign coun-
tries, including China, for rare earth mining and the proc-
essing or production of rare earth elements; 
(C) the intentions of foreign governments, including 
the government of China, with respect to limiting, reducing,
H. R. 2471—986 
or ending access of the United States or the partners and 
allies of the United States to— 
(i) rare earth elements; or 
(ii) any aspect of the rare earth mining, processing, 
or production chain; and 
(D) opportunities for the United States, and for the 
partners and allies of the United States, to assure contin-
ued access to— 
(i) rare earth elements; and 
(ii) the rare earth mining, processing, or production 
chain. 
(2) A description of— 
(A) any relevant procurement, use, and supply chain 
needs of the intelligence community with respect to rare 
earth elements; 
(B) any relevant planning or efforts by the intelligence 
community to assure secured access to rare earth elements; 
(C) any assessed vulnerabilities or risks to the intel-
ligence community with respect to rare earth elements; 
(D) any relevant planning or efforts by the intelligence 
community to coordinate with departments and agencies 
of the United States Government that are not elements 
of the intelligence community on securing the rare earth 
element supply chain; and 
(E) any previous or anticipated efforts by the Supply 
Chain and Counterintelligence Risk Management Task 
Force established under section 6306 of the Damon Paul 
Nelson and Matthew Young Pollard Intelligence Authoriza-
tion Act for Fiscal Years 2018, 2019, and 2020 (50 U.S.C. 
3370) with respect to rare earth elements. 
(c) FORM.—The report under subsection (a) shall be submitted 
in unclassified form, but may include a classified annex. 
(d) RARE EARTH ELEMENTS DEFINED.—In this section, the term 
‘‘rare earth elements’’ includes products that contain rare earth 
elements, including rare earth magnets. 
SEC. 831. REPORT ON ASSESSMENT OF ALL-SOURCE CYBER INTEL-
LIGENCE INFORMATION. 
(a) REPORT REQUIRED.—Not later than 180 days after the date 
of the enactment of this Act, the Inspector General of the Intel-
ligence Community, in coordination with the Inspector General 
of the National Security Agency and the Inspector General of the 
Central Intelligence Agency, shall submit to the congressional intel-
ligence committees a report on the effectiveness of the intelligence 
community with respect to the integration and dissemination of 
all-source intelligence relating to foreign cyber threats. 
(b) CONTENTS.—The report under subsection (a) shall include 
the following: 
(1) An assessment of the effectiveness of the all-source 
cyber intelligence integration capabilities of the intelligence 
community, including the identification of capability gaps 
relating to the integration of all-source intelligence, or any 
deficiencies associated with the timely dissemination of such 
intelligence. 
(2) An assessment of the effectiveness of the intelligence 
community in analyzing and reporting on cyber supply chain 
risks, including with respect to interagency coordination and
H. R. 2471—987 
the leadership of the Office of the Director of National Intel-
ligence. 
SEC. 832. BRIEFING ON TRAININGS RELATING TO BLOCKCHAIN TECH-
NOLOGY. 
(a) BRIEFING.—Not later than 90 days after the date of the 
enactment of this Act, the Director of National Intelligence shall 
provide to the congressional intelligence committees a briefing on 
the feasibility and benefits of providing training described in sub-
section (b). 
(b) TRAINING DESCRIBED.—Training described in this subsection 
is training that meets the following criteria: 
(1) The training is on cryptocurrency, blockchain tech-
nology, or both subjects. 
(2) The training may be provided through partnerships 
with universities or private sector entities. 
SEC. 833. REPORT ON TRENDS IN TECHNOLOGIES OF STRATEGIC 
IMPORTANCE TO UNITED STATES. 
(a) IN GENERAL.—Not less frequently than once every 2 years 
until the date that is 4 years after the date of the enactment 
of this Act, the Director of National Intelligence, in consultation 
with the Secretary of Commerce and the Director of the Office 
of Science and Technology Policy, shall submit to the congressional 
intelligence committees a report assessing commercial and foreign 
trends in technologies the Director considers of strategic importance 
to the national and economic security of the United States. 
(b) CONTENTS.—Each report under subsection (a) shall include 
the following: 
(1) A list of the top technology focus areas the Director 
determines to be of the greatest strategic importance to the 
United States. 
(2) A list of the top technology focus areas in which the 
Director determines foreign countries that are adversarial to 
the United States are poised to match or surpass the techno-
logical leadership of the United States. 
(c) FORM.—Each report under subsection (a)— 
(1) may be submitted in the form of a National Intelligence 
Estimate; and 
(2) shall be submitted in classified form, but may include 
an unclassified summary. 
SEC. 834. PLAN FOR ARTIFICIAL INTELLIGENCE DIGITAL ECOSYSTEM. 
(a) PLAN.—Not later than 1 year after the date of the enactment 
of this Act, the Director of National Intelligence shall coordinate 
with the heads of other elements of the intelligence community 
and, in conjunction with the heads of those elements, shall— 
(1) develop a plan for the development and resourcing 
of a modern digital ecosystem that embraces state-of-the-art 
tools and modern processes to enable development, testing, 
fielding, and continuous updating of artificial intelligence-pow-
ered applications at speed and scale from headquarters to the 
tactical edge; and 
(2) submit to the congressional intelligence committees the 
plan developed under paragraph (1). 
(b) CONTENTS OF PLAN.—At a minimum, the plan required 
by subsection (a) shall include the following:
H. R. 2471—988 
(1) Policies to enable elements of the intelligence commu-
nity to adopt a hoteling model to allow trusted small- and 
medium-sized artificial intelligence companies access to classi-
fied facilities on a flexible basis. 
(2) Policies for an open architecture and an evolving ref-
erence design and guidance for needed technical investments 
in the proposed ecosystem that address issues, including 
common interfaces, authentication, applications, platforms, soft-
ware, hardware, and data infrastructure. 
(3) Policies to ensure, to the extent possible, interoper-
ability, and the reduction of duplication, of artificial intelligence 
capabilities developed or acquired by elements of the intel-
ligence community. 
(4) A governance structure, together with associated poli-
cies and guidance, to drive the implementation of the reference 
throughout the intelligence community on a federated basis. 
(5) Community standards for the use of artificial intel-
ligence and associated data, as appropriate. 
(6) Recommendations to ensure that use of artificial intel-
ligence and associated data by the Federal Government related 
to United States persons comport with rights relating to 
freedom of expression, equal protection, privacy, and due 
process. 
(c) FORM.—The plan submitted under subsection (a)(2) shall 
be submitted in unclassified form, but may include a classified 
annex. 
SEC. 835. REPORTS ON INTELLIGENCE SUPPORT FOR AND CAPACITY 
OF THE SERGEANTS AT ARMS OF THE SENATE AND THE 
HOUSE OF REPRESENTATIVES AND THE UNITED STATES 
CAPITOL POLICE. 
(a) REPORT ON INTELLIGENCE SUPPORT.— 
(1) REQUIREMENT.—Not later than 60 days after the date 
of the enactment of this Act, the Director of National Intel-
ligence, in coordination with the Director of the Federal Bureau 
of Investigation and the Secretary of Homeland Security, shall 
submit to the congressional intelligence committees, the Sub-
committees on Commerce, Justice, Science, and Related Agen-
cies and the Subcommittees on Homeland Security of the 
Committees on Appropriations of the House of Representatives 
and the Senate, and congressional leadership a report on intel-
ligence support provided to the Sergeants at Arms and the 
United States Capitol Police. 
(2) ELEMENTS.—The report under paragraph (1) shall 
include a description of the following: 
(A) Policies related to the Sergeants at Arms and the 
United States Capitol Police as customers of intelligence. 
(B) How the intelligence community, the Federal 
Bureau of Investigation, and the Department of Homeland 
Security, including the Cybersecurity and Infrastructure 
Security Agency, are structured, staffed, and resourced to 
provide intelligence support to the Sergeants at Arms and 
the United States Capitol Police. 
(C) The classified electronic and telephony interoper-
ability of the intelligence community, the Federal Bureau 
of Investigation, and the Department of Homeland Security
H. R. 2471—989 
with the Sergeants at Arms and the United States Capitol 
Police. 
(D) Any expedited security clearances provided for the 
Sergeants at Arms and the United States Capitol Police. 
(E) Counterterrorism intelligence and other intel-
ligence relevant to the physical security of Congress that 
are provided to the Sergeants at Arms and the United 
States Capitol Police, including— 
(i) strategic analysis and real-time warning; and 
(ii) access to classified systems for transmitting 
and posting intelligence. 
(F) Cyber intelligence relevant to the protection of 
cyber networks of Congress and the personal devices and 
accounts 
of 
Members 
and 
employees 
of 
Congress, 
including— 
(i) strategic and real-time warnings, such as 
malware signatures and other indications of attack; 
and 
(ii) access to classified systems for transmitting 
and posting intelligence. 
(3) FORM.—The report under paragraph (1) shall be sub-
mitted in unclassified form, but may include a classified annex. 
(b) GOVERNMENT ACCOUNTABILITY OFFICE REPORT.— 
(1) REQUIREMENT.—Not later than 180 days after the date 
of the enactment of this Act, the Comptroller General of the 
United States shall submit to the appropriate congressional 
committees and congressional leadership a report on the 
capacity of the Sergeants at Arms and the United States Capitol 
Police to access and use intelligence and threat information 
relevant to the physical and cyber security of Congress. 
(2) ELEMENTS.—The report under paragraph (1) shall 
include the following: 
(A) An assessment of the extent to which the Sergeants 
at Arms and the United States Capitol Police have the 
resources, including facilities, cleared personnel, and nec-
essary training, and authorities to adequately access, ana-
lyze, manage, and use intelligence and threat information 
necessary to defend the physical and cyber security of 
Congress. 
(B) The extent to which the Sergeants at Arms and 
the United States Capitol Police communicate and coordi-
nate threat data with each other and with other local 
law enforcement entities. 
(3) FORM.—The report under paragraph (1) shall be sub-
mitted in unclassified form, but may include a classified annex. 
(c) DEFINITIONS.—In this section: 
(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term 
‘‘appropriate congressional committees’’ means— 
(A) the congressional intelligence committees; 
(B) the Committee on Homeland Security and Govern-
mental Affairs, the Committee on Rules and Administra-
tion, the Committee on the Judiciary, and the Committee 
on Appropriations of the Senate; and 
(C) the Committee on Homeland Security, the Com-
mittee on House Administration, the Committee on the 
Judiciary, and the Committee on Appropriations of the 
House of Representatives.
H. R. 2471—990 
(2) CONGRESSIONAL LEADERSHIP.—The term ‘‘congressional 
leadership’’ means— 
(A) the majority leader of the Senate; 
(B) the minority leader of the Senate; 
(C) the Speaker of the House of Representatives; and 
(D) the minority leader of the House of Representa-
tives. 
(3) SERGEANTS AT ARMS.—The term ‘‘Sergeants at Arms’’ 
means the Sergeant at Arms and Doorkeeper of the Senate, 
the Sergeant at Arms of the House of Representatives, and 
the Chief Administrative Officer of the House of Representa-
tives. 
DIVISION Y—CYBER INCIDENT REPORT-
ING FOR CRITICAL INFRASTRUCTURE 
ACT OF 2022 
SEC. 101. SHORT TITLE. 
This division may be cited as the ‘‘Cyber Incident Reporting 
for Critical Infrastructure Act of 2022’’. 
SEC. 102. DEFINITIONS. 
In this division: 
(1) COVERED
CYBER
INCIDENT; COVERED
ENTITY; CYBER 
INCIDENT; 
INFORMATION
SYSTEM; 
RANSOM
PAYMENT; 
RANSOMWARE
ATTACK; SECURITY
VULNERABILITY.—The terms 
‘‘covered cyber incident’’, ‘‘covered entity’’, ‘‘cyber incident’’, 
‘‘information system’’, ‘‘ransom payment’’, ‘‘ransomware attack’’, 
and ‘‘security vulnerability’’ have the meanings given those 
terms in section 2240 of the Homeland Security Act of 2002, 
as added by section 103 of this division. 
(2) DIRECTOR.—The term ‘‘Director’’ means the Director 
of the Cybersecurity and Infrastructure Security Agency. 
SEC. 103. CYBER INCIDENT REPORTING. 
(a) CYBER INCIDENT REPORTING.—Title XXII of the Homeland 
Security Act of 2002 (6 U.S.C. 651 et seq.) is amended— 
(1) in section 2209(c) (6 U.S.C. 659(c))— 
(A) in paragraph (11), by striking ‘‘; and’’ and inserting 
a semicolon; 
(B) in paragraph (12), by striking the period at the 
end and inserting ‘‘; and’’; and 
(C) by adding at the end the following: 
‘‘(13) receiving, aggregating, and analyzing reports related 
to covered cyber incidents (as defined in section 2240) submitted 
by covered entities (as defined in section 2240) and reports 
related to ransom payments (as defined in section 2240) sub-
mitted by covered entities (as defined in section 2240) in fur-
therance of the activities specified in sections 2202(e), 2203, 
and 2241, this subsection, and any other authorized activity 
of the Director, to enhance the situational awareness of cyberse-
curity threats across critical infrastructure sectors.’’; and 
(2) by adding at the end the following:
H. R. 2471—991 
‘‘Subtitle D—Cyber Incident Reporting 
‘‘SEC. 2240. DEFINITIONS. 
‘‘In this subtitle: 
‘‘(1) CENTER.—The term ‘Center’ means the center estab-
lished under section 2209. 
‘‘(2) CLOUD SERVICE PROVIDER.—The term ‘cloud service 
provider’ means an entity offering products or services related 
to cloud computing, as defined by the National Institute of 
Standards and Technology in NIST Special Publication 800– 
145 and any amendatory or superseding document relating 
thereto. 
‘‘(3) COUNCIL.—The term ‘Council’ means the Cyber 
Incident Reporting Council described in section 2246. 
‘‘(4) COVERED CYBER INCIDENT.—The term ‘covered cyber 
incident’ means a substantial cyber incident experienced by 
a covered entity that satisfies the definition and criteria estab-
lished by the Director in the final rule issued pursuant to 
section 2242(b). 
‘‘(5) COVERED
ENTITY.—The term ‘covered entity’ means 
an entity in a critical infrastructure sector, as defined in Presi-
dential Policy Directive 21, that satisfies the definition estab-
lished by the Director in the final rule issued pursuant to 
section 2242(b). 
‘‘(6) CYBER INCIDENT.—The term ‘cyber incident’— 
‘‘(A) has the meaning given the term ‘incident’ in sec-
tion 2209; and 
‘‘(B) does not include an occurrence that imminently, 
but not actually, jeopardizes— 
‘‘(i) information on information systems; or 
‘‘(ii) information systems. 
‘‘(7) CYBER
THREAT.—The term ‘cyber threat’ has the 
meaning given the term ‘cybersecurity threat’ in section 2201. 
‘‘(8) CYBER THREAT INDICATOR; CYBERSECURITY PURPOSE; 
DEFENSIVE
MEASURE; 
FEDERAL
ENTITY; 
SECURITY
VULNER-
ABILITY.—The terms ‘cyber threat indicator’, ‘cybersecurity pur-
pose’, ‘defensive measure’, ‘Federal entity’, and ‘security vulner-
ability’ have the meanings given those terms in section 102 
of the Cybersecurity Act of 2015 (6 U.S.C. 1501). 
‘‘(9) INCIDENT; SHARING.—The terms ‘incident’ and ‘sharing’ 
have the meanings given those terms in section 2209. 
‘‘(10) INFORMATION SHARING AND ANALYSIS ORGANIZATION.— 
The term ‘Information Sharing and Analysis Organization’ has 
the meaning given the term in section 2222. 
‘‘(11) 
INFORMATION
SYSTEM.—The 
term 
‘information 
system’— 
‘‘(A) has the meaning given the term in section 3502 
of title 44, United States Code; and 
‘‘(B) includes industrial control systems, such as super-
visory control and data acquisition systems, distributed 
control systems, and programmable logic controllers. 
‘‘(12) MANAGED
SERVICE
PROVIDER.—The term ‘managed 
service provider’ means an entity that delivers services, such 
as network, application, infrastructure, or security services, 
via ongoing and regular support and active administration on
H. R. 2471—992 
the premises of a customer, in the data center of the entity 
(such as hosting), or in a third party data center. 
‘‘(13) RANSOM
PAYMENT.—The term ‘ransom payment’ 
means the transmission of any money or other property or 
asset, including virtual currency, or any portion thereof, which 
has at any time been delivered as ransom in connection with 
a ransomware attack. 
‘‘(14) 
RANSOMWARE
ATTACK.—The 
term 
‘ransomware 
attack’— 
‘‘(A) means an incident that includes the use or threat 
of use of unauthorized or malicious code on an information 
system, or the use or threat of use of another digital 
mechanism such as a denial of service attack, to interrupt 
or disrupt the operations of an information system or com-
promise the confidentiality, availability, or integrity of elec-
tronic data stored on, processed by, or transiting an 
information system to extort a demand for a ransom pay-
ment; and 
‘‘(B) does not include any such event where the demand 
for payment is— 
‘‘(i) not genuine; or 
‘‘(ii) made in good faith by an entity in response 
to a specific request by the owner or operator of the 
information system. 
‘‘(15) SECTOR RISK MANAGEMENT AGENCY.—The term ‘Sector 
Risk Management Agency’ has the meaning given the term 
in section 2201. 
‘‘(16) SIGNIFICANT CYBER INCIDENT.—The term ‘significant 
cyber incident’ means a cyber incident, or a group of related 
cyber incidents, that the Secretary determines is likely to result 
in demonstrable harm to the national security interests, foreign 
relations, or economy of the United States or to the public 
confidence, civil liberties, or public health and safety of the 
people of the United States. 
‘‘(17) SUPPLY CHAIN COMPROMISE.—The term ‘supply chain 
compromise’ means an incident within the supply chain of 
an information system that an adversary can leverage or does 
leverage to jeopardize the confidentiality, integrity, or avail-
ability of the information system or the information the system 
processes, stores, or transmits, and can occur at any point 
during the life cycle. 
‘‘(18) VIRTUAL
CURRENCY.—The term ‘virtual currency’ 
means the digital representation of value that functions as 
a medium of exchange, a unit of account, or a store of value. 
‘‘(19) VIRTUAL CURRENCY ADDRESS.—The term ‘virtual cur-
rency address’ means a unique public cryptographic key identi-
fying the location to which a virtual currency payment can 
be made. 
‘‘SEC. 2241. CYBER INCIDENT REVIEW. 
‘‘(a) ACTIVITIES.—The Center shall— 
‘‘(1) receive, aggregate, analyze, and secure, using processes 
consistent with the processes developed pursuant to the Cyber-
security Information Sharing Act of 2015 (6 U.S.C. 1501 et 
seq.) reports from covered entities related to a covered cyber 
incident to assess the effectiveness of security controls, identify 
tactics, techniques, and procedures adversaries use to overcome
H. R. 2471—993 
those controls and other cybersecurity purposes, including to 
assess potential impact of cyber incidents on public health 
and safety and to enhance situational awareness of cyber 
threats across critical infrastructure sectors; 
‘‘(2) coordinate and share information with appropriate Fed-
eral departments and agencies to identify and track ransom 
payments, including those utilizing virtual currencies; 
‘‘(3) leverage information gathered about cyber incidents 
to— 
‘‘(A) enhance the quality and effectiveness of informa-
tion sharing and coordination efforts with appropriate enti-
ties, including agencies, sector coordinating councils, 
Information Sharing and Analysis Organizations, State, 
local, Tribal, and territorial governments, technology pro-
viders, critical infrastructure owners and operators, cyber-
security and cyber incident response firms, and security 
researchers; and 
‘‘(B) provide appropriate entities, including sector 
coordinating councils, Information Sharing and Analysis 
Organizations, State, local, Tribal, and territorial govern-
ments, technology providers, cybersecurity and cyber 
incident response firms, and security researchers, with 
timely, actionable, and anonymized reports of cyber 
incident campaigns and trends, including, to the maximum 
extent practicable, related contextual information, cyber 
threat indicators, and defensive measures, pursuant to sec-
tion 2245; 
‘‘(4) establish mechanisms to receive feedback from stake-
holders on how the Agency can most effectively receive covered 
cyber incident reports, ransom payment reports, and other vol-
untarily provided information, and how the Agency can most 
effectively support private sector cybersecurity; 
‘‘(5) facilitate the timely sharing, on a voluntary basis, 
between relevant critical infrastructure owners and operators 
of information relating to covered cyber incidents and ransom 
payments, particularly with respect to ongoing cyber threats 
or security vulnerabilities and identify and disseminate ways 
to prevent or mitigate similar cyber incidents in the future; 
‘‘(6) for a covered cyber incident, including a ransomware 
attack, that also satisfies the definition of a significant cyber 
incident, or is part of a group of related cyber incidents that 
together satisfy such definition, conduct a review of the details 
surrounding the covered cyber incident or group of those 
incidents and identify and disseminate ways to prevent or 
mitigate similar incidents in the future; 
‘‘(7) with respect to covered cyber incident reports under 
section 2242(a) and 2243 involving an ongoing cyber threat 
or security vulnerability, immediately review those reports for 
cyber threat indicators that can be anonymized and dissemi-
nated, with defensive measures, to appropriate stakeholders, 
in coordination with other divisions within the Agency, as 
appropriate; 
‘‘(8) publish quarterly unclassified, public reports that 
describe aggregated, anonymized observations, findings, and 
recommendations based on covered cyber incident reports, 
which may be based on the unclassified information contained 
in the briefings required under subsection (c);
H. R. 2471—994 
‘‘(9) proactively identify opportunities, consistent with the 
protections in section 2245, to leverage and utilize data on 
cyber incidents in a manner that enables and strengthens cyber-
security research carried out by academic institutions and other 
private sector organizations, to the greatest extent practicable; 
and 
‘‘(10) in accordance with section 2245 and subsection (b) 
of this section, as soon as possible but not later than 24 hours 
after receiving a covered cyber incident report, ransom payment 
report, voluntarily submitted information pursuant to section 
2243, or information received pursuant to a request for informa-
tion or subpoena under section 2244, make available the 
information to appropriate Sector Risk Management Agencies 
and other appropriate Federal agencies. 
‘‘(b) INTERAGENCY SHARING.—The President or a designee of 
the President— 
‘‘(1) may establish a specific time requirement for sharing 
information under subsection (a)(10); and 
‘‘(2) shall determine the appropriate Federal agencies under 
subsection (a)(10). 
‘‘(c) PERIODIC BRIEFING.—Not later than 60 days after the effec-
tive date of the final rule required under section 2242(b), and 
on the first day of each month thereafter, the Director, in consulta-
tion with the National Cyber Director, the Attorney General, and 
the Director of National Intelligence, shall provide to the majority 
leader of the Senate, the minority leader of the Senate, the Speaker 
of the House of Representatives, the minority leader of the House 
of Representatives, the Committee on Homeland Security and 
Governmental Affairs of the Senate, and the Committee on Home-
land Security of the House of Representatives a briefing that 
characterizes the national cyber threat landscape, including the 
threat facing Federal agencies and covered entities, and applicable 
intelligence and law enforcement information, covered cyber 
incidents, and ransomware attacks, as of the date of the briefing, 
which shall— 
‘‘(1) include the total number of reports submitted under 
sections 2242 and 2243 during the preceding month, including 
a breakdown of required and voluntary reports; 
‘‘(2) include any identified trends in covered cyber incidents 
and ransomware attacks over the course of the preceding month 
and as compared to previous reports, including any trends 
related to the information collected in the reports submitted 
under sections 2242 and 2243, including— 
‘‘(A) the infrastructure, tactics, and techniques mali-
cious cyber actors commonly use; and 
‘‘(B) intelligence gaps that have impeded, or currently 
are impeding, the ability to counter covered cyber incidents 
and ransomware threats; 
‘‘(3) include a summary of the known uses of the informa-
tion in reports submitted under sections 2242 and 2243; and 
‘‘(4) include an unclassified portion, but may include a 
classified component. 
‘‘SEC. 2242. REQUIRED REPORTING OF CERTAIN CYBER INCIDENTS. 
‘‘(a) IN GENERAL.— 
‘‘(1) COVERED CYBER INCIDENT REPORTS.—
H. R. 2471—995 
‘‘(A) IN GENERAL.—A covered entity that experiences 
a covered cyber incident shall report the covered cyber 
incident to the Agency not later than 72 hours after the 
covered entity reasonably believes that the covered cyber 
incident has occurred. 
‘‘(B) LIMITATION.—The Director may not require 
reporting under subparagraph (A) any earlier than 72 hours 
after the covered entity reasonably believes that a covered 
cyber incident has occurred. 
‘‘(2) RANSOM PAYMENT REPORTS.— 
‘‘(A) IN
GENERAL.—A covered entity that makes a 
ransom payment as the result of a ransomware attack 
against the covered entity shall report the payment to 
the Agency not later than 24 hours after the ransom pay-
ment has been made. 
‘‘(B) APPLICATION.—The requirements under subpara-
graph (A) shall apply even if the ransomware attack is 
not a covered cyber incident subject to the reporting 
requirements under paragraph (1). 
‘‘(3) SUPPLEMENTAL
REPORTS.—A covered entity shall 
promptly submit to the Agency an update or supplement to 
a previously submitted covered cyber incident report if substan-
tial new or different information becomes available or if the 
covered entity makes a ransom payment after submitting a 
covered cyber incident report required under paragraph (1), 
until such date that such covered entity notifies the Agency 
that the covered cyber incident at issue has concluded and 
has been fully mitigated and resolved. 
‘‘(4) PRESERVATION OF INFORMATION.—Any covered entity 
subject to requirements of paragraph (1), (2), or (3) shall pre-
serve data relevant to the covered cyber incident or ransom 
payment in accordance with procedures established in the final 
rule issued pursuant to subsection (b). 
‘‘(5) EXCEPTIONS.— 
‘‘(A) REPORTING
OF
COVERED
CYBER
INCIDENT
WITH 
RANSOM
PAYMENT.—If a covered entity is the victim of 
a covered cyber incident and makes a ransom payment 
prior to the 72 hour requirement under paragraph (1), 
such that the reporting requirements under paragraphs 
(1) and (2) both apply, the covered entity may submit 
a single report to satisfy the requirements of both para-
graphs in accordance with procedures established in the 
final rule issued pursuant to subsection (b). 
‘‘(B) SUBSTANTIALLY SIMILAR REPORTED INFORMATION.— 
‘‘(i) 
IN
GENERAL.—Subject 
to 
the 
limitation 
described in clause (ii), where the Agency has an agree-
ment in place that satisfies the requirements of section 
104(a) of the Cyber Incident Reporting for Critical 
Infrastructure Act of 2022, the requirements under 
paragraphs (1), (2), and (3) shall not apply to a covered 
entity required by law, regulation, or contract to report 
substantially similar information to another Federal 
agency within a substantially similar timeframe. 
‘‘(ii) LIMITATION.—The exemption in clause (i) shall 
take effect with respect to a covered entity once an 
agency agreement and sharing mechanism is in place 
between the Agency and the respective Federal agency,