‘‘(B) an assessment of the sufficiency of 
the policies, procedures, and guidelines estab-
lished pursuant to section 4 of the Protecting 
Cyber Networks Act and the amendments made 
by such section 4 in addressing privacy and civil 
liberties concerns.’’. 
(B) INITIAL REPORT.—The first report re-
quired under paragraph (3) of section 1061(e) 
of the Intelligence Reform and Terrorism Pre-
vention Act of 2004 (42 U.S.C. 2000ee(e)), as 
added by subparagraph (A) of this paragraph, 
shall be submitted not later than 2 years after 
the date of the enactment of this Act. 
(2) BIENNIAL
REPORT
OF
INSPECTORS
GEN-
ERAL.— 
(A) IN GENERAL.—Not later than 2 years 
after the date of the enactment of this Act and 
not less frequently than once every 2 years 
thereafter, the Inspector General of the Depart-
ment of Homeland Security, the Inspector Gen-
eral of the Intelligence Community, the Inspec-
tor General of the Department of Justice, and 
the Inspector General of the Department of De-
fense, in consultation with the Council of In-
spectors General on Financial Oversight, shall 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
jointly submit to Congress a report on the re-
ceipt, use, and dissemination of cyber threat in-
dicators and defensive measures that have been 
shared with Federal entities under this Act and 
the amendments made by this Act. 
(B) CONTENTS.—Each report submitted 
under subparagraph (A) shall include the fol-
lowing: 
(i) A review of the types of cyber 
threat indicators shared with Federal enti-
ties. 
(ii) A review of the actions taken by 
Federal entities as a result of the receipt 
of such cyber threat indicators. 
(iii) A list of Federal entities receiving 
such cyber threat indicators. 
(iv) A review of the sharing of such 
cyber threat indicators among Federal en-
tities to identify inappropriate barriers to 
sharing information. 
(3) RECOMMENDATIONS.—Each report sub-
mitted under this subsection may include such rec-
ommendations as the Privacy and Civil Liberties 
Oversight Board, with respect to a report submitted 
under paragraph (1), or the Inspectors General re-
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
ferred to in paragraph (2)(A), with respect to a re-
port submitted under paragraph (2), may have for 
improvements or modifications to the authorities 
under this Act or the amendments made by this Act. 
(4) FORM.—Each report required under this 
subsection shall be submitted in unclassified form, 
but may include a classified annex. 
SEC. 8. REPORT ON CYBERSECURITY THREATS. 
(a) REPORT REQUIRED.—Not later than 180 days 
after the date of the enactment of this Act, the Director 
of National Intelligence, in consultation with the heads of 
other appropriate elements of the intelligence community, 
shall submit to the Select Committee on Intelligence of 
the Senate and the Permanent Select Committee on Intel-
ligence of the House of Representatives a report on cyber-
security threats, including cyber attacks, theft, and data 
breaches. 
(b) CONTENTS.—The report required by subsection 
(a) shall include the following: 
(1) An assessment of— 
(A) the current intelligence sharing and co-
operation relationships of the United States 
with other countries regarding cybersecurity 
threats (including cyber attacks, theft, and data 
breaches) directed against the United States 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
that threaten the United States national secu-
rity interests, economy, and intellectual prop-
erty; and 
(B) the relative utility of such relation-
ships, which elements of the intelligence com-
munity participate in such relationships, and 
whether and how such relationships could be 
improved. 
(2) A list and an assessment of the countries 
and non-state actors that are the primary threats of 
carrying out a cybersecurity threat (including a 
cyber attack, theft, or data breach) against the 
United States and that threaten the United States 
national security, economy, and intellectual property. 
(3) A description of the extent to which the ca-
pabilities of the United States Government to re-
spond to or prevent cybersecurity threats (including 
cyber attacks, theft, or data breaches) directed 
against the United States private sector are de-
graded by a delay in the prompt notification by pri-
vate entities of such threats or cyber attacks, theft, 
and breaches. 
(4) An assessment of additional technologies or 
capabilities that would enhance the ability of the 
United States to prevent and to respond to cyberse-
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
curity threats (including cyber attacks, theft, and 
data breaches). 
(5) An assessment of any technologies or prac-
tices utilized by the private sector that could be rap-
idly fielded to assist the intelligence community in 
preventing and responding to cybersecurity threats. 
(c) FORM OF REPORT.—The report required by sub-
section (a) shall be submitted in unclassified form, but 
may include a classified annex. 
(d) INTELLIGENCE COMMUNITY DEFINED.—In this 
section, the term ‘‘intelligence community’’ has the mean-
ing given that term in section 3 of the National Security 
Act of 1947 (50 U.S.C. 3003). 
SEC. 9. CONSTRUCTION AND PREEMPTION. 
(a) PROHIBITION OF SURVEILLANCE.—Nothing in 
this Act or the amendments made by this Act shall be 
construed to authorize the Department of Defense or the 
National Security Agency or any other element of the in-
telligence community to target a person for surveillance. 
(b) OTHERWISE LAWFUL DISCLOSURES.—Nothing in 
this Act or the amendments made by this Act shall be 
construed to limit or prohibit— 
(1) otherwise lawful disclosures of communica-
tions, records, or other information, including re-
porting of known or suspected criminal activity, by 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
a non-Federal entity to any other non-Federal entity 
or the Federal Government; or 
(2) any otherwise lawful use of such disclosures 
by any entity of the Federal government, without re-
gard to whether such otherwise lawful disclosures 
duplicate or replicate disclosures made under this 
Act. 
(c) WHISTLE BLOWER PROTECTIONS.—Nothing in 
this Act or the amendments made by this Act shall be 
construed to prohibit or limit the disclosure of information 
protected under section 2302(b)(8) of title 5, United 
States Code (governing disclosures of illegality, waste, 
fraud, abuse, or public health or safety threats), section 
7211 of title 5, United States Code (governing disclosures 
to Congress), section 1034 of title 10, United States Code 
(governing disclosure to Congress by members of the mili-
tary), or any similar provision of Federal or State law. 
(d) PROTECTION
OF SOURCES
AND METHODS.— 
Nothing in this Act or the amendments made by this Act 
shall be construed— 
(1) as creating any immunity against, or other-
wise affecting, any action brought by the Federal 
Government, or any department or agency thereof, 
to enforce any law, executive order, or procedure 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
(g) PRESERVATION OF CONTRACTUAL OBLIGATIONS 
AND RIGHTS.—Nothing in this Act or the amendments 
made by this Act shall be construed— 
(1) to amend, repeal, or supersede any current 
or future contractual agreement, terms of service 
agreement, or other contractual relationship between 
any non-Federal entities, or between any non-Fed-
eral entity and a Federal entity; or 
(2) to abrogate trade secret or intellectual prop-
erty rights of any non-Federal entity or Federal en-
tity. 
(h) ANTI-TASKING RESTRICTION.—Nothing in this 
Act or the amendments made by this Act shall be con-
strued to permit the Federal Government— 
(1) to require a non-Federal entity to provide 
information to the Federal Government; 
(2) to condition the sharing of a cyber threat 
indicator with a non-Federal entity on such non- 
Federal entity’s provision of a cyber threat indicator 
to the Federal Government; or 
(3) to condition the award of any Federal 
grant, contract, or purchase on the provision of a 
cyber threat indicator to a Federal entity. 
(i) NO LIABILITY FOR NON-PARTICIPATION.—Noth-
ing in this Act or the amendments made by this Act shall 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
be construed to subject any non-Federal entity to liability 
for choosing not to engage in a voluntary activiy author-
ized in this Act and the amendments made by this Act. 
(j) USE AND RETENTION OF INFORMATION.—Noth-
ing in this Act or the amendments made by this Act shall 
be construed to authorize, or to modify any existing au-
thority of, a department or agency of the Federal Govern-
ment to retain or use any information shared under this 
Act or the amendments made by this Act for any use other 
than permitted in this Act or the amendments made by 
this Act. 
(k) FEDERAL PREEMPTION.— 
(1) IN GENERAL.—This Act and the amend-
ments made by this Act supersede any statute or 
other provision of law of a State or political subdivi-
sion of a State that restricts or otherwise expressly 
regulates an activity authorized under this Act or 
the amendments made by this Act. 
(2) STATE
LAW
ENFORCEMENT.—Nothing in 
this Act or the amendments made by this Act shall 
be construed to supersede any statute or other provi-
sion of law of a State or political subdivision of a 
State concerning the use of authorized law enforce-
ment practices and procedures. 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
(l) REGULATORY AUTHORITY.—Nothing in this Act 
or the amendments made by this Act shall be construed— 
(1) to authorize the promulgation of any regu-
lations not specifically authorized by this Act or the 
amendments made by this Act; 
(2) to establish any regulatory authority not 
specifically established under this Act or the amend-
ments made by this Act; or 
(3) to authorize regulatory actions that would 
duplicate or conflict with regulatory requirements, 
mandatory standards, or related processes under an-
other provision of Federal law. 
SEC. 10. CONFORMING AMENDMENTS. 
Section 552(b) of title 5, United States Code, is 
amended— 
(1) in paragraph (8), by striking ‘‘or’’ at the 
end; 
(2) in paragraph (9), by striking ‘‘wells.’’ and 
inserting ‘‘wells; or’’; and 
(3) by inserting after paragraph (9) the fol-
lowing: 
‘‘(10) information shared with or provided to 
the Federal Government pursuant to the Protecting 
Cyber Networks Act or the amendments made by 
such Act.’’. 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
SEC. 11. DEFINITIONS. 
In this Act: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given the term in section 3502 of title 44, 
United States Code. 
(2) APPROPRIATE
FEDERAL
ENTITIES.—The 
term ‘‘appropriate Federal entities’’ means the fol-
lowing: 
(A) The Department of Commerce. 
(B) The Department of Defense. 
(C) The Department of Energy. 
(D) The Department of Homeland Secu-
rity. 
(E) The Department of Justice. 
(F) The Department of the Treasury. 
(G) The Office of the Director of National 
Intelligence. 
(3) CYBERSECURITY PURPOSE.—The term ‘‘cy-
bersecurity purpose’’ means the purpose of pro-
tecting an information system or information that is 
stored on, processed by, or transiting an information 
system from a cybersecurity threat or security vul-
nerability or identifying the source of a cybersecurity 
threat or using a defensive measure. 
(4) CYBERSECURITY THREAT.— 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘cybersecurity 
threat’’ means an action, not protected by the 
first amendment to the Constitution of the 
United States, on or through an information 
system that may result in an unauthorized ef-
fort to adversely impact the security, confiden-
tiality, integrity, or availability of an informa-
tion system or information that is stored on, 
processed by, or transiting an information sys-
tem. 
(B) EXCLUSION.—The term ‘‘cybersecurity 
threat’’ does not include any action that solely 
involves a violation of a consumer term of serv-
ice or a consumer licensing agreement. 
(5) CYBER
THREAT
INDICATOR.—The term 
‘‘cyber threat indicator’’ means information or a 
physical object that is necessary to describe or iden-
tify— 
(A) malicious reconnaissance, including 
anomalous patterns of communications that ap-
pear to be transmitted for the purpose of gath-
ering technical information related to a cyberse-
curity threat or security vulnerability; 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS
(B) a method of defeating a security con-
trol or exploitation of a security vulnerability; 
(C) a security vulnerability, including 
anomalous activity that appears to indicate the 
existence of a security vulnerability; 
(D) a method of causing a user with legiti-
mate access to an information system or infor-
mation that is stored on, processed by, or 
transiting an information system to unwittingly 
enable the defeat of a security control or exploi-
tation of a security vulnerability; 
(E) malicious cyber command and control; 
(F) the actual or potential harm caused by 
an incident, including a description of the infor-
mation exfiltrated as a result of a particular cy-
bersecurity threat; or 
(G) any other attribute of a cybersecurity 
threat, if disclosure of such attribute is not oth-
erwise prohibited by law. 
(6) DEFENSIVE MEASURE.—The term ‘‘defen-
sive measure’’ means an action, device, procedure, 
technique, or other measure executed on an informa-
tion system or information that is stored on, proc-
essed by, or transiting an information system that 
VerDate Sep 11 2014 
04:01 Mar 31, 2015
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.IH
H1560
smartinez on DSK4TPTVN1PROD with BILLS