I 
114TH CONGRESS 
1ST SESSION H. R. 3039 
To impose penalties on state-sponsors of cyberattacks, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 13, 2015 
Mr. BROOKS of Alabama introduced the following bill; which was referred to 
the Committee on Foreign Affairs, and in addition to the Committees on 
Ways and Means, Financial Services, and Oversight and Government Re-
form, for a period to be subsequently determined by the Speaker, in each 
case for consideration of such provisions as fall within the jurisdiction of 
the committee concerned 
A BILL 
To impose penalties on state-sponsors of cyberattacks, and 
for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Providing Retaliation 
Options against Those Engaging in Cyberattacks Tar-
geting the United States Act’’ or ‘‘PROTECT US Act’’. 
SEC. 2. FINDINGS. 
Congress finds the following: 
VerDate Sep 11 2014 
03:27 Jul 15, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3039.IH
H3039
SSpencer on DSK4SPTVN1PROD with BILLS
(1) Article XXI of the GATT 1994 (as such 
term is defined in section 2(1)(B) of the Uruguay 
Round Agreements Act (19 U.S.C. 3501(1)(B))) al-
lows a member of the World Trade Organization to 
take any action which such member considers nec-
essary for the protection of such member’s essential 
security interests. 
(2) Protecting the United States from malicious 
cyber-enabled activities is essential to the security 
interests of the United States. 
SEC. 3. IMPOSITION OF PENALTIES ON STATE-SPONSORS 
OF CYBERATTACKS. 
(a) IN GENERAL.—The President is authorized to 
impose penalties described in subsection (c) with respect 
to each country on the list required by subsection (b). 
(b) LIST OF STATE-SPONSORS OF CYBERATTACKS.— 
(1) IN GENERAL.—Not later than 60 days after 
the date of the enactment of this Act, the President 
shall submit to Congress a list of countries des-
ignated as state-sponsors of cyberattacks pursuant 
to paragraph (2). 
(2) COUNTRIES
DESIGNATED.—If the Presi-
dent, in consultation with the Secretary of Home-
land Security, the Secretary of Defense, the Attor-
ney General, and the Chairman of the United States 
VerDate Sep 11 2014 
03:27 Jul 15, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3039.IH
H3039
SSpencer on DSK4SPTVN1PROD with BILLS
International Trade Commission, determines that 
the United States or a United States person has 
been targeted in a malicious cyber-enabled activity 
originating from, or directed by a person located, in 
whole or in substantial part, in a foreign country, 
and such activity is reasonably likely to result in, or 
have materially contributed to, a threat to the na-
tional security or foreign policy of the United States, 
or harmed the economic health or financial stability 
of the United States or a United States person, or 
has the purpose or effect of— 
(A) harming or otherwise significantly 
compromising the provision of services by a 
computer or network of computers that support 
the United States or a United States person in 
a critical infrastructure sector, 
(B) significantly compromising the provi-
sion of services by the United States or a 
United States person in a critical infrastructure 
sector, 
(C) causing significant disruption to the 
availability of a computer or network of com-
puters owned or operated by the United States 
or a United States person, or 
VerDate Sep 11 2014 
03:27 Jul 15, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3039.IH
H3039
SSpencer on DSK4SPTVN1PROD with BILLS
(D) causing a significant misappropriation 
of funds or economic resources, trade secrets, 
personally identifiable information, or financial 
information of the United States or a United 
States person, 
the President shall designate such country as a 
state-sponsor of cyberattacks. 
(3) UPDATES
OF
LIST.—The President shall 
submit to Congress an updated list under paragraph 
(1) as new information becomes available. 
(c) PENALTIES.— 
(1) TRADE-RELATED PENALTY.—The President 
may impose a duty, in addition to any other duty 
imposed, on any article or service imported directly 
or indirectly into the United States that is produced 
in whole or in part in a country that is included on 
the list of state-sponsors of cyberattacks required by 
subsection (b). 
(2) OTHER ACTIONS.—The President may take 
any of the following actions with respect to a coun-
try that is included on the list of state-sponsors of 
cyberattacks required by subsection (b): 
(A) A private demarche. 
(B) An official public demarche. 
(C) A public condemnation. 
VerDate Sep 11 2014 
03:27 Jul 15, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3039.IH
H3039
SSpencer on DSK4SPTVN1PROD with BILLS
(D) A public condemnation within one or 
more multilateral fora. 
(E) The delay or cancellation of one or 
more scientific exchanges. 
(F) The delay or cancellation of one or 
more cultural exchanges. 
(G) The denial of one or more working, of-
ficial, or state visits. 
(H) The delay or cancellation of one or 
more working, official, or state visits. 
(I) The withdrawal, limitation, or suspen-
sion of United States development assistance 
under chapter 1 of part I of the Foreign Assist-
ance Act of 1961. 
(J) Directing the Export-Import Bank of 
the United States, the Overseas Private Invest-
ment Corporation, or the Trade and Develop-
ment Agency to not approve the issuance of any 
(or a specified number of) guarantees, insur-
ance, extensions of credit, or participations in 
extensions of credit. 
(K) The withdrawal, limitation, or suspen-
sion of United States security assistance under 
part II of the Foreign Assistance Act of 1961. 
VerDate Sep 11 2014 
03:27 Jul 15, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3039.IH
H3039
SSpencer on DSK4SPTVN1PROD with BILLS
(L) Consistent with section 701 of the 
International Financial Institutions Act, direct-
ing the United States Executive Directors at 
international financial institutions to oppose 
and vote against loans primarily benefitting the 
country. 
(M) Ordering the heads of the appropriate 
United States agencies to not issue any (or a 
specified number of) specific licenses, and to 
not grant any other specific authority (or a 
specified number of authorities), to export any 
goods or technology to such country under— 
(i) the Export Administration Act of 
1979 (as continued in effect pursuant the 
International Emergency Economic Powers 
Act); 
(ii) the Arms Export Control Act; 
(iii) the Atomic Energy Act of 1954; 
or 
(iv) any other statute that requires 
the prior review and approval of the 
United States Government as a condition 
for the export or re-export of goods or 
services. 
VerDate Sep 11 2014 
03:27 Jul 15, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3039.IH
H3039
SSpencer on DSK4SPTVN1PROD with BILLS
(N) Prohibiting any United States finan-
cial institution from making loans or providing 
credits. 
(O) Prohibiting the United States Govern-
ment from procuring, or entering into any con-
tract for the procurement of, any goods or serv-
ices. 
(P) Suspension or withdrawal of extension 
of nondiscriminatory treatment to the products 
of the country pursuant to section 404 of the 
Trade Act of 1974. 
(Q) Ordering a trade embargo. 
(R) Ordering a cyber counterattack. 
(d) REMOVAL FROM LIST.— 
(1) IN GENERAL.—A country may be removed 
from the list of state-sponsors of cyberattacks re-
quired by subsection (b) if— 
(A) the President determines that the 
country no longer meets the requirements for 
designation as a state-sponsor of cyberattacks 
under subsection (b)(2); or 
(B) Congress enacts a law that provides 
for such removal. 
(2) MORATORIUM.— 
VerDate Sep 11 2014 
03:27 Jul 15, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3039.IH
H3039
SSpencer on DSK4SPTVN1PROD with BILLS
(A) IN
GENERAL.—A country that has 
been removed from the list pursuant to para-
graph (1)(B) may not be added back to the list 
by the President until at least the date that is 
one year after the date of such removal. 
(B) RULE OF CONSTRUCTION.—Nothing in 
this paragraph shall be construed as prohibiting 
Congress from adding a country that has been 
removed from the list pursuant to paragraph 
(1)(B) back to the list by a date that is earlier 
than the date described in subparagraph (A). 
(e) DEFINITIONS.—In this section: 
(1) CRITICAL INFRASTRUCTURE SECTOR.—The 
term ‘‘critical infrastructure sector’’ means any of 
the designated critical infrastructure sectors identi-
fied in Presidential Policy Directive 21. 
(2) ENTITY.—The term ‘‘entity’’ means a part-
nership, association, trust, joint venture, corpora-
tion, group, subgroup, government, or other organi-
zation. 
(3) LIST.—The term ‘‘list’’ means the list of 
state-sponsors of cyberattacks. 
(4) MISAPPROPRIATION.—The term ‘‘misappro-
priation’’ means any taking or obtaining by im-
VerDate Sep 11 2014 
03:27 Jul 15, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3039.IH
H3039
SSpencer on DSK4SPTVN1PROD with BILLS
proper means, without permission or consent, or 
under false pretenses. 
(5) PERSON.—The term ‘‘person’’ means a nat-
ural person or an entity. 
(6) 
UNITED
STATES
PERSON.—The 
term 
‘‘United States person’’ shall be broadly construed 
to include but not be limited to any United States 
citizen, permanent resident alien, entity organized 
under the laws of the United States or any jurisdic-
tion within the United States (including foreign 
branches), any governmental or quasi-governmental 
entity existing in the United States, or any other 
person in the United States. 
Æ 
VerDate Sep 11 2014 
03:27 Jul 15, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H3039.IH
H3039
SSpencer on DSK4SPTVN1PROD with BILLS