HR 1560 RFS
‘‘(B) LAWFUL RESTRICTION.—A non-Fed-
eral entity receiving a cyber threat indicator or 
defensive measure from another Federal entity 
or non-Federal entity shall comply with other-
wise lawful restrictions placed on the sharing or 
use of such cyber threat indicator or defensive 
measure by the sharing Federal entity or non- 
Federal entity. 
‘‘(C) REMOVAL
OF
INFORMATION
UNRE-
LATED
TO
CYBERSECURITY
RISKS
OR
INCI-
DENTS.—Federal entities and non-Federal enti-
ties shall, prior to such sharing, take reasonable 
efforts to remove or exclude information that 
can be used to identify specific persons and is 
reasonably believed at the time of sharing to be 
unrelated to a cybersecurity risk or incident and 
to safeguard information that can be used to 
identify specific persons from unintended disclo-
sure or unauthorized access or acquisition. 
‘‘(D) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) limit or modify an existing infor-
mation sharing relationship; 
‘‘(ii) prohibit a new information shar-
ing relationship; 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
‘‘(iii) require a new information shar-
ing relationship between any non-Federal 
entity and a Federal entity; 
‘‘(iv) limit otherwise lawful activity; or 
‘‘(v) in any manner impact or modify 
procedures in existence as of the date of 
the enactment of this section for reporting 
known or suspected criminal activity to ap-
propriate law enforcement authorities or 
for participating voluntarily or under legal 
requirement in an investigation. 
‘‘(E) COORDINATED VULNERABILITY DIS-
CLOSURE.—The Under Secretary for Cyberse-
curity and Infrastructure Protection, in coordi-
nation with industry and other stakeholders, 
shall develop, publish, and adhere to policies 
and procedures for coordinating vulnerability 
disclosures, to the extent practicable, consistent 
with international standards in the information 
technology industry. 
‘‘(4) NETWORK AWARENESS AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government, 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
may, for cybersecurity purposes, conduct net-
work awareness of— 
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity, upon written consent 
of such other non-Federal entity for con-
ducting such network awareness to protect 
the rights or property of such other non- 
Federal entity; 
‘‘(iii) an information system of a Fed-
eral entity, upon written consent of an au-
thorized representative of such Federal en-
tity for conducting such network awareness 
to protect the rights or property of such 
Federal entity; or 
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) authorize conducting network 
awareness of an information system, or the 
use of any information obtained through 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
such conducting of network awareness, 
other than as provided in this section; or 
‘‘(ii) limit otherwise lawful activity. 
‘‘(5) DEFENSIVE MEASURE AUTHORIZATION.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B) and notwithstanding any 
other provision of law, a non-Federal entity, not 
including a State, local, or tribal government, 
may, for cybersecurity purposes, operate a de-
fensive measure that is applied to— 
‘‘(i) an information system of such 
non-Federal entity to protect the rights or 
property of such non-Federal entity; 
‘‘(ii) an information system of another 
non-Federal entity upon written consent of 
such other non-Federal entity for operation 
of such defensive measure to protect the 
rights or property of such other non-Fed-
eral entity; 
‘‘(iii) an information system of a Fed-
eral entity upon written consent of an au-
thorized representative of such Federal en-
tity for operation of such defensive meas-
ure to protect the rights or property of 
such Federal entity; or 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
‘‘(iv) information that is stored on, 
processed by, or transiting an information 
system described in this subparagraph. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in this paragraph may be construed to— 
‘‘(i) authorize the use of a defensive 
measure other than as provided in this sec-
tion; or 
‘‘(ii) limit otherwise lawful activity. 
‘‘(6) PRIVACY AND CIVIL LIBERTIES PROTEC-
TIONS.— 
‘‘(A) POLICIES AND PROCEDURES.— 
‘‘(i) IN GENERAL.—The Under Sec-
retary for Cybersecurity and Infrastructure 
Protection shall, in coordination with the 
Chief Privacy Officer and the Chief Civil 
Rights and Civil Liberties Officer of the 
Department, establish and annually review 
policies and procedures governing the re-
ceipt, retention, use, and disclosure of 
cyber threat indicators, defensive meas-
ures, and information related to cybersecu-
rity risks and incidents shared with the 
Center in accordance with this section. 
Such policies and procedures shall apply 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
HR 1560 RFS
only to the Department, consistent with 
the need to protect information systems 
from cybersecurity risks and incidents and 
mitigate cybersecurity risks and incidents 
in a timely manner, and shall— 
‘‘(I) be consistent with the De-
partment’s Fair Information Practice 
Principles developed pursuant to sec-
tion 552a of title 5, United States 
Code (commonly referred to as the 
‘Privacy Act of 1974’ or the ‘Privacy 
Act’), and subject to the Secretary’s 
authority under subsection (a)(2) of 
section 222 of this Act; 
‘‘(II) reasonably limit, to the 
greatest extent practicable, the re-
ceipt, retention, use, and disclosure of 
cyber threat indicators and defensive 
measures associated with specific per-
sons that is not necessary, for cyber-
security purposes, to protect a net-
work or information system from cy-
bersecurity risks or mitigate cyberse-
curity risks and incidents in a timely 
manner; 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS