I 
114TH CONGRESS 
1ST SESSION 
H. R. 234 
To provide for the sharing of certain cyber threat intelligence and cyber 
threat information between the intelligence community and cybersecurity 
entities, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 8, 2015 
Mr. RUPPERSBERGER introduced the following bill; which was referred to the 
Select Committee on Intelligence (Permanent Select), and in addition to 
the Committees on the Judiciary, Armed Services, and Homeland Secu-
rity, for a period to be subsequently determined by the Speaker, in each 
case for consideration of such provisions as fall within the jurisdiction of 
the committee concerned 
A BILL 
To provide for the sharing of certain cyber threat intelligence 
and cyber threat information between the intelligence 
community and cybersecurity entities, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber Intelligence 
Sharing and Protection Act’’. 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
SEC. 2. FEDERAL GOVERNMENT COORDINATION WITH RE-
SPECT TO CYBERSECURITY. 
(a) COORDINATED ACTIVITIES.—The Federal Gov-
ernment shall conduct cybersecurity activities to provide 
shared situational awareness that enables integrated oper-
ational actions to protect, prevent, mitigate, respond to, 
and recover from cyber incidents. 
(b) COORDINATED INFORMATION SHARING.— 
(1) DESIGNATION
OF
COORDINATING
ENTITY 
FOR CYBER THREAT INFORMATION.—The President 
shall designate an entity within the Department of 
Homeland Security as the civilian Federal entity to 
receive cyber threat information that is shared by a 
cybersecurity provider or self-protected entity in ac-
cordance with section 1104(b) of the National Secu-
rity Act of 1947, as added by section 3(a) of this 
Act, except as provided in paragraph (2) and subject 
to the procedures established under paragraph (4). 
(2) DESIGNATION OF A COORDINATING ENTITY 
FOR CYBERSECURITY CRIMES.—The President shall 
designate an entity within the Department of Justice 
as the civilian Federal entity to receive cyber threat 
information related to cybersecurity crimes that is 
shared by a cybersecurity provider or self-protected 
entity in accordance with section 1104(b) of the Na-
tional Security Act of 1947, as added by section 3(a) 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
of this Act, subject to the procedures under para-
graph (4). 
(3) SHARING
BY
COORDINATING
ENTITIES.— 
The entities designated under paragraphs (1) and 
(2) shall share cyber threat information shared with 
such entities in accordance with section 1104(b) of 
the National Security Act of 1947, as added by sec-
tion 3(a) of this Act, consistent with the procedures 
established under paragraphs (4) and (5). 
(4) PROCEDURES.—Each department or agency 
of the Federal Government receiving cyber threat in-
formation shared in accordance with section 1104(b) 
of the National Security Act of 1947, as added by 
section 3(a) of this Act, shall establish procedures 
to— 
(A) ensure that cyber threat information 
shared with departments or agencies of the 
Federal Government in accordance with such 
section 1104(b) is also shared with appropriate 
departments and agencies of the Federal Gov-
ernment with a national security mission in real 
time; 
(B) ensure the distribution to other de-
partments and agencies of the Federal Govern-
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
ment of cyber threat information in real time; 
and 
(C) facilitate information sharing, inter-
action, and collaboration among and between 
the Federal Government; State, local, tribal, 
and territorial governments; and cybersecurity 
providers and self-protected entities. 
(5) PRIVACY AND CIVIL LIBERTIES.— 
(A) POLICIES
AND
PROCEDURES.—The 
Secretary of Homeland Security, the Attorney 
General, the Director of National Intelligence, 
and the Secretary of Defense shall jointly estab-
lish and periodically review policies and proce-
dures governing the receipt, retention, use, and 
disclosure of non-publicly available cyber threat 
information shared with the Federal Govern-
ment in accordance with section 1104(b) of the 
National Security Act of 1947, as added by sec-
tion 3(a) of this Act. Such policies and proce-
dures shall, consistent with the need to protect 
systems and networks from cyber threats and 
mitigate cyber threats in a timely manner— 
(i) minimize the impact on privacy 
and civil liberties; 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
(ii) reasonably limit the receipt, reten-
tion, use, and disclosure of cyber threat in-
formation associated with specific persons 
that is not necessary to protect systems or 
networks from cyber threats or mitigate 
cyber threats in a timely manner; 
(iii) include requirements to safeguard 
non-publicly available cyber threat infor-
mation that may be used to identify spe-
cific persons from unauthorized access or 
acquisition; 
(iv) protect the confidentiality of cyber 
threat information associated with specific 
persons to the greatest extent practicable; 
and 
(v) not delay or impede the flow of 
cyber threat information necessary to de-
fend against or mitigate a cyber threat. 
(B) SUBMISSION TO CONGRESS.—The Sec-
retary of Homeland Security, the Attorney Gen-
eral, the Director of National Intelligence, and 
the Secretary of Defense shall, consistent with 
the need to protect sources and methods, jointly 
submit to Congress the policies and procedures 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
required under subparagraph (A) and any up-
dates to such policies and procedures. 
(C) IMPLEMENTATION.—The head of each 
department or agency of the Federal Govern-
ment receiving cyber threat information shared 
with the Federal Government under such sec-
tion 1104(b) shall— 
(i) implement the policies and proce-
dures established under subparagraph (A); 
and 
(ii) promptly notify the Secretary of 
Homeland Security, the Attorney General, 
the Director of National Intelligence, the 
Secretary of Defense, and the appropriate 
congressional committees of any significant 
violations of such policies and procedures. 
(D) OVERSIGHT.—The Secretary of Home-
land Security, the Attorney General, the Direc-
tor of National Intelligence, and the Secretary 
of Defense shall jointly establish a program to 
monitor and oversee compliance with the poli-
cies and procedures established under subpara-
graph (A). 
(6) INFORMATION SHARING RELATIONSHIPS.— 
Nothing in this section shall be construed to— 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
(A) alter existing agreements or prohibit 
new agreements with respect to the sharing of 
cyber threat information between the Depart-
ment of Defense and an entity that is part of 
the defense industrial base; 
(B) alter existing information-sharing rela-
tionships between a cybersecurity provider, pro-
tected entity, or self-protected entity and the 
Federal Government; 
(C) prohibit the sharing of cyber threat in-
formation directly with a department or agency 
of the Federal Government for criminal inves-
tigative purposes related to crimes described in 
section 1104(c)(1) of the National Security Act 
of 1947, as added by section 3(a) of this Act; 
or 
(D) alter existing agreements or prohibit 
new agreements with respect to the sharing of 
cyber threat information between the Depart-
ment of Treasury and an entity that is part of 
the financial services sector. 
(7) TECHNICAL ASSISTANCE.— 
(A) 
DISCUSSIONS
AND
ASSISTANCE.— 
Nothing in this section shall be construed to 
prohibit any department or agency of the Fed-
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
(i) formal or informal technical dis-
cussions between such entity of the De-
partment of Homeland Security and a cy-
bersecurity provider or self-protected entity 
about cyber threat information; or 
(ii) any technical assistance such enti-
ty of the Department of Homeland Secu-
rity provides to such cybersecurity provider 
or such self-protected entity to address 
vulnerabilities or mitigate threats. 
(c) REPORTS ON INFORMATION SHARING.— 
(1) INSPECTOR GENERAL OF THE DEPARTMENT 
OF HOMELAND SECURITY REPORT.—The Inspector 
General of the Department of Homeland Security, in 
consultation with the Inspector General of the De-
partment of Justice, the Inspector General of the In-
telligence Community, the Inspector General of the 
Department of Defense, and the Privacy and Civil 
Liberties Oversight Board, shall annually submit to 
the appropriate congressional committees a report 
containing a review of the use of information shared 
with the Federal Government under subsection (b) 
of section 1104 of the National Security Act of 
1947, as added by section 3(a) of this Act, includ-
ing— 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
(A) a review of the use by the Federal 
Government of such information for a purpose 
other than a cybersecurity purpose; 
(B) a review of the type of information 
shared with the Federal Government under 
such subsection; 
(C) a review of the actions taken by the 
Federal Government based on such information; 
(D) appropriate metrics to determine the 
impact of the sharing of such information with 
the Federal Government on privacy and civil 
liberties, if any; 
(E) a list of the departments or agencies 
receiving such information; 
(F) a review of the sharing of such infor-
mation within the Federal Government to iden-
tify inappropriate stovepiping of shared infor-
mation; and 
(G) any recommendations of the Inspector 
General of the Department of Homeland Secu-
rity for improvements or modifications to the 
authorities under such section. 
(2) PRIVACY AND CIVIL LIBERTIES OFFICERS 
REPORT.—The Officer for Civil Rights and Civil 
Liberties of the Department of Homeland Security, 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
in consultation with the Privacy and Civil Liberties 
Oversight Board, the Inspector General of the Intel-
ligence Community, and the senior privacy and civil 
liberties officer of each department or agency of the 
Federal Government that receives cyber threat infor-
mation shared with the Federal Government under 
such subsection (b), shall annually and jointly sub-
mit to Congress a report assessing the privacy and 
civil liberties impact of the activities conducted by 
the Federal Government under such section 1104. 
Such report shall include any recommendations the 
Civil Liberties Protection Officer and Chief Privacy 
and Civil Liberties Officer consider appropriate to 
minimize or mitigate the privacy and civil liberties 
impact of the sharing of cyber threat information 
under such section 1104. 
(3) FORM.—Each report required under para-
graph (1) or (2) shall be submitted in unclassified 
form, but may include a classified annex. 
(d) DEFINITIONS.—In this section: 
(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the Committee on Homeland Security, 
the Committee on the Judiciary, the Permanent 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
Select Committee on Intelligence, and the Com-
mittee on Armed Services of the House of Rep-
resentatives; and 
(B) the Committee on Homeland Security 
and Governmental Affairs, the Committee on 
the Judiciary, the Select Committee on Intel-
ligence, and the Committee on Armed Services 
of the Senate. 
(2) CYBER
THREAT
INFORMATION, 
CYBER 
THREAT
INTELLIGENCE, CYBERSECURITY
CRIMES, 
CYBERSECURITY
PROVIDER, CYBERSECURITY
PUR-
POSE, AND SELF-PROTECTED ENTITY.—The terms 
‘‘cyber threat information’’, ‘‘cyber threat intel-
ligence’’, ‘‘cybersecurity crimes’’, ‘‘cybersecurity pro-
vider’’, ‘‘cybersecurity purpose’’, and ‘‘self-protected 
entity’’ have the meaning given those terms in sec-
tion 1104 of the National Security Act of 1947, as 
added by section 3(a) of this Act. 
(3) INTELLIGENCE
COMMUNITY.—The term 
‘‘intelligence community’’ has the meaning given the 
term in section 3(4) of the National Security Act of 
1947 (50 U.S.C. 401a(4)). 
(4) SHARED
SITUATIONAL
AWARENESS.—The 
term ‘‘shared situational awareness’’ means an envi-
ronment where cyber threat information is shared in 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
real time between all designated Federal cyber oper-
ations centers to provide actionable information 
about all known cyber threats. 
SEC. 3. CYBER THREAT INTELLIGENCE AND INFORMATION 
SHARING. 
(a) IN GENERAL.—Title XI of the National Security 
Act of 1947 (50 U.S.C. 442 et seq.) is amended by adding 
at the end the following new section: 
‘‘CYBER THREAT INTELLIGENCE AND INFORMATION 
SHARING 
‘‘SEC. 1104. (a) INTELLIGENCE COMMUNITY SHAR-
ING OF CYBER THREAT INTELLIGENCE WITH PRIVATE 
SECTOR AND UTILITIES.— 
‘‘(1) IN GENERAL.—The Director of National 
Intelligence shall establish procedures to allow ele-
ments of the intelligence community to share cyber 
threat intelligence with private-sector entities and 
utilities and to encourage the sharing of such intel-
ligence. 
‘‘(2) SHARING AND USE OF CLASSIFIED INTEL-
LIGENCE.—The procedures established under para-
graph (1) shall provide that classified cyber threat 
intelligence may only be— 
‘‘(A) shared by an element of the intel-
ligence community with— 
‘‘(i) a certified entity; or 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(ii) a person with an appropriate se-
curity clearance to receive such cyber 
threat intelligence; 
‘‘(B) shared consistent with the need to 
protect the national security of the United 
States; 
‘‘(C) used by a certified entity in a manner 
which protects such cyber threat intelligence 
from unauthorized disclosure; and 
‘‘(D) used, retained, or further disclosed by 
a certified entity for cybersecurity purposes. 
‘‘(3) SECURITY CLEARANCE APPROVALS.—The 
Director of National Intelligence shall issue guide-
lines providing that the head of an element of the 
intelligence community may, as the head of such ele-
ment considers necessary to carry out this sub-
section— 
‘‘(A) grant a security clearance on a tem-
porary or permanent basis to an employee, 
independent contractor, or officer of a certified 
entity; 
‘‘(B) grant a security clearance on a tem-
porary or permanent basis to a certified entity 
and approval to use appropriate facilities; and 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(C) expedite the security clearance proc-
ess for a person or entity as the head of such 
element considers necessary, consistent with the 
need to protect the national security of the 
United States. 
‘‘(4) NO RIGHT OR BENEFIT.—The provision of 
information to a private-sector entity or a utility 
under this subsection shall not create a right or ben-
efit to similar information by such entity or such 
utility or any other private-sector entity or utility. 
‘‘(5) RESTRICTION ON DISCLOSURE OF CYBER 
THREAT
INTELLIGENCE.—Notwithstanding 
any 
other provision of law, a certified entity receiving 
cyber threat intelligence pursuant to this subsection 
shall not further disclose such cyber threat intel-
ligence to another entity, other than to a certified 
entity or other appropriate agency or department of 
the Federal Government authorized to receive such 
cyber threat intelligence. 
‘‘(b) USE OF CYBERSECURITY SYSTEMS AND SHAR-
ING OF CYBER THREAT INFORMATION.— 
‘‘(1) IN GENERAL.— 
‘‘(A) CYBERSECURITY
PROVIDERS.—Not-
withstanding any other provision of law, a cy-
bersecurity provider, with the express consent 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
of a protected entity for which such cybersecu-
rity provider is providing goods or services for 
cybersecurity purposes, may, for cybersecurity 
purposes— 
‘‘(i) use cybersecurity systems to iden-
tify and obtain cyber threat information to 
protect the rights and property of such 
protected entity; and 
‘‘(ii) share such cyber threat informa-
tion with any other entity designated by 
such protected entity, including, if specifi-
cally designated, the entities of the Depart-
ment of Homeland Security and the De-
partment of Justice designated under 
paragraphs (1) and (2) of section 2(b) of 
the Cyber Intelligence Sharing and Protec-
tion Act. 
‘‘(B) SELF-PROTECTED
ENTITIES.—Not-
withstanding any other provision of law, a self- 
protected entity may, for cybersecurity pur-
poses— 
‘‘(i) use cybersecurity systems to iden-
tify and obtain cyber threat information to 
protect the rights and property of such 
self-protected entity; and 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(ii) share such cyber threat informa-
tion with any other entity, including the 
entities of the Department of Homeland 
Security and the Department of Justice 
designated under paragraphs (1) and (2) 
of section 2(b) of the Cyber Intelligence 
Sharing and Protection Act. 
‘‘(2) USE
AND
PROTECTION
OF
INFORMA-
TION.—Cyber threat information shared in accord-
ance with paragraph (1)— 
‘‘(A) shall only be shared in accordance 
with any restrictions placed on the sharing of 
such information by the protected entity or self- 
protected entity authorizing such sharing, in-
cluding appropriate anonymization or minimiza-
tion of such information and excluding limiting 
a department or agency of the Federal Govern-
ment from sharing such information with an-
other department or agency of the Federal Gov-
ernment in accordance with this section; 
‘‘(B) may not be used by an entity to gain 
an unfair competitive advantage to the det-
riment of the protected entity or the self-pro-
tected entity authorizing the sharing of infor-
mation; 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(C) may only be used by a non-Federal 
recipient of such information for a cybersecurity 
purpose; 
‘‘(D) if shared with the Federal Govern-
ment— 
‘‘(i) shall be exempt from disclosure 
under section 552 of title 5, United States 
Code (commonly known as the ‘Freedom of 
Information Act’); 
‘‘(ii) shall be considered proprietary 
information and shall not be disclosed to 
an entity outside of the Federal Govern-
ment except as authorized by the entity 
sharing such information; 
‘‘(iii) shall not be used by the Federal 
Government for regulatory purposes; 
‘‘(iv) shall not be provided to another 
department or agency of the Federal Gov-
ernment under paragraph (2)(A) if— 
‘‘(I) the entity providing such in-
formation determines that the provi-
sion of such information will under-
mine the purpose for which such in-
formation is shared; or 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(II) unless otherwise directed by 
the President, the head of the depart-
ment or agency of the Federal Gov-
ernment receiving such cyber threat 
information determines that the provi-
sion of such information will under-
mine the purpose for which such in-
formation is shared; and 
‘‘(v) shall be handled by the Federal 
Government consistent with the need to 
protect sources and methods and the na-
tional security of the United States; and 
‘‘(E) shall be exempt from disclosure under 
a law or regulation of a State, political subdivi-
sion of a State, or a tribe that requires public 
disclosure of information by a public or quasi- 
public entity. 
‘‘(3) EXEMPTION FROM LIABILITY.— 
‘‘(A) EXEMPTION.—No civil or criminal 
cause of action shall lie or be maintained in 
Federal or State court against a protected enti-
ty, self-protected entity, cybersecurity provider, 
or an officer, employee, or agent of a protected 
entity, self-protected entity, or cybersecurity 
provider, acting in good faith— 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(i) for using cybersecurity systems to 
identify or obtain cyber threat information 
or for sharing such information in accord-
ance with this section; or 
‘‘(ii) for decisions made for cybersecu-
rity purposes and based on cyber threat in-
formation identified, obtained, or shared 
under this section. 
‘‘(B) LACK
OF
GOOD
FAITH.—For pur-
poses of the exemption from liability under sub-
paragraph (A), a lack of good faith includes 
any act or omission taken with intent to injure, 
defraud, or otherwise endanger any individual, 
government entity, private entity, or utility. 
‘‘(4) RELATIONSHIP TO OTHER LAWS REQUIR-
ING THE DISCLOSURE OF INFORMATION.—The sub-
mission of information under this subsection to the 
Federal Government shall not satisfy or affect— 
‘‘(A) any requirement under any other pro-
vision of law for a person or entity to provide 
information to the Federal Government; or 
‘‘(B) the applicability of other provisions of 
law, including section 552 of title 5, United 
States Code (commonly known as the ‘Freedom 
of Information Act’), with respect to informa-
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
tion required to be provided to the Federal Gov-
ernment under such other provision of law. 
‘‘(5) RULE
OF
CONSTRUCTION.—Nothing in 
this subsection shall be construed to provide new au-
thority to— 
‘‘(A) a cybersecurity provider to use a cy-
bersecurity system to identify or obtain cyber 
threat information from a system or network 
other than a system or network owned or oper-
ated by a protected entity for which such cyber-
security provider is providing goods or services 
for cybersecurity purposes; or 
‘‘(B) a self-protected entity to use a cyber-
security system to identify or obtain cyber 
threat information from a system or network 
other than a system or network owned or oper-
ated by such self-protected entity. 
‘‘(c) FEDERAL GOVERNMENT USE
OF INFORMA-
TION.— 
‘‘(1) LIMITATION.—The Federal Government 
may use cyber threat information shared with the 
Federal Government in accordance with subsection 
(b)— 
‘‘(A) for cybersecurity purposes; 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
eral Government receiving information pursuant to 
subsection (b)(1) determines that such information 
is not cyber threat information, such department or 
agency shall notify the entity or provider sharing 
such information pursuant to subsection (b)(1). 
‘‘(6) RETENTION AND USE OF CYBER THREAT 
INFORMATION.—No department or agency of the 
Federal Government shall retain or use information 
shared pursuant to subsection (b)(1) for any use 
other than a use permitted under subsection (c)(1). 
‘‘(d) FEDERAL GOVERNMENT LIABILITY FOR VIOLA-
TIONS OF RESTRICTIONS ON THE DISCLOSURE, USE, AND 
PROTECTION OF VOLUNTARILY SHARED INFORMATION.— 
‘‘(1) IN GENERAL.—If a department or agency 
of the Federal Government intentionally or willfully 
violates subsection (b)(3)(D) or subsection (c) with 
respect to the disclosure, use, or protection of volun-
tarily shared cyber threat information shared under 
this section, the United States shall be liable to a 
person adversely affected by such violation in an 
amount equal to the sum of— 
‘‘(A) the actual damages sustained by the 
person as a result of the violation or $1,000, 
whichever is greater; and 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(B) the costs of the action together with 
reasonable attorney fees as determined by the 
court. 
‘‘(2) VENUE.—An action to enforce liability cre-
ated under this subsection may be brought in the 
district court of the United States in— 
‘‘(A) the district in which the complainant 
resides; 
‘‘(B) the district in which the principal 
place of business of the complainant is located; 
‘‘(C) the district in which the department 
or agency of the Federal Government that dis-
closed the information is located; or 
‘‘(D) the District of Columbia. 
‘‘(3) STATUTE
OF
LIMITATIONS.—No action 
shall lie under this subsection unless such action is 
commenced not later than two years after the date 
of the violation of subsection (b)(3)(D) or subsection 
(c) that is the basis for the action. 
‘‘(4) EXCLUSIVE CAUSE OF ACTION.—A cause 
of action under this subsection shall be the exclusive 
means available to a complainant seeking a remedy 
for a violation of subsection (b)(3)(D) or subsection 
(c). 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(e) FEDERAL PREEMPTION.—This section super-
sedes any statute of a State or political subdivision of a 
State that restricts or otherwise expressly regulates an ac-
tivity authorized under subsection (b). 
‘‘(f) SAVINGS CLAUSES.— 
‘‘(1) EXISTING AUTHORITIES.—Nothing in this 
section shall be construed to limit any other author-
ity to use a cybersecurity system or to identify, ob-
tain, or share cyber threat intelligence or cyber 
threat information. 
‘‘(2) LIMITATION
ON
MILITARY
AND
INTEL-
LIGENCE
COMMUNITY
INVOLVEMENT
IN
PRIVATE 
AND PUBLIC SECTOR CYBERSECURITY EFFORTS.— 
Nothing in this section shall be construed to provide 
additional authority to, or modify an existing au-
thority of, the Department of Defense or the Na-
tional Security Agency or any other element of the 
intelligence community to control, modify, require, 
or otherwise direct the cybersecurity efforts of a pri-
vate-sector entity or a component of the Federal 
Government or a State, local, or tribal government. 
‘‘(3) INFORMATION SHARING RELATIONSHIPS.— 
Nothing in this section shall be construed to— 
‘‘(A) limit or modify an existing informa-
tion sharing relationship; 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(B) prohibit a new information sharing 
relationship; 
‘‘(C) require a new information sharing re-
lationship between the Federal Government and 
a private-sector entity or utility; 
‘‘(D) modify the authority of a department 
or agency of the Federal Government to protect 
sources and methods and the national security 
of the United States; or 
‘‘(E) preclude the Federal Government 
from requiring an entity to report significant 
cyber incidents if authorized or required to do 
so under another provision of law. 
‘‘(4) LIMITATION
ON
FEDERAL
GOVERNMENT 
USE OF CYBERSECURITY SYSTEMS.—Nothing in this 
section shall be construed to provide additional au-
thority to, or modify an existing authority of, any 
entity to use a cybersecurity system owned or con-
trolled by the Federal Government on a private-sec-
tor system or network to protect such private-sector 
system or network. 
‘‘(5) NO LIABILITY FOR NON-PARTICIPATION.— 
Nothing in this section shall be construed to subject 
a protected entity, self-protected entity, cybersecu-
rity provider, or an officer, employee, or agent of a 
VerDate Sep 11 2014 
21:56 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
protected entity, self-protected entity, or cybersecu-
rity provider, to liability for choosing not to engage 
in the voluntary activities authorized under this sec-
tion. 
‘‘(6) USE AND RETENTION OF INFORMATION.— 
Nothing in this section shall be construed to author-
ize, or to modify any existing authority of, a depart-
ment or agency of the Federal Government to retain 
or use information shared pursuant to subsection 
(b)(1) for any use other than a use permitted under 
subsection (c)(1). 
‘‘(7) LIMITATION ON SURVEILLANCE.—Nothing 
in this section shall be construed to authorize the 
Department of Defense or the National Security 
Agency or any other element of the intelligence com-
munity to target a United States person for surveil-
lance. 
‘‘(g) DEFINITIONS.—In this section: 
‘‘(1) AVAILABILITY.—The term ‘availability’ 
means ensuring timely and reliable access to and use 
of information. 
‘‘(2) CERTIFIED ENTITY.—The term ‘certified 
entity’ means a protected entity, self-protected enti-
ty, or cybersecurity provider that— 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(A) possesses or is eligible to obtain a se-
curity clearance, as determined by the Director 
of National Intelligence; and 
‘‘(B) is able to demonstrate to the Director 
of National Intelligence that such provider or 
such entity can appropriately protect classified 
cyber threat intelligence. 
‘‘(3) CONFIDENTIALITY.—The term ‘confiden-
tiality’ means preserving authorized restrictions on 
access and disclosure, including means for protecting 
personal privacy and proprietary information. 
‘‘(4) CYBER THREAT INFORMATION.— 
‘‘(A) IN
GENERAL.—The term ‘cyber 
threat information’ means information directly 
pertaining to— 
‘‘(i) a vulnerability of a system or net-
work of a government or private entity or 
utility; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network of a government or private entity 
or utility or any information stored on, 
processed on, or transiting such a system 
or network; 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work of a government or private entity or 
utility; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network of a govern-
ment or private entity or utility, including 
to gain such unauthorized access for the 
purpose of exfiltrating information stored 
on, processed on, or transiting a system or 
network of a government or private entity 
or utility. 
‘‘(B) EXCLUSION.—Such term does not in-
clude information pertaining to efforts to gain 
unauthorized access to a system or network of 
a government or private entity or utility that 
solely involve violations of consumer terms of 
service or consumer licensing agreements and 
do not otherwise constitute unauthorized access. 
‘‘(5) CYBER THREAT INTELLIGENCE.— 
‘‘(A) IN
GENERAL.—The term ‘cyber 
threat intelligence’ means intelligence in the 
possession of an element of the intelligence 
community directly pertaining to— 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(i) a vulnerability of a system or net-
work of a government or private entity or 
utility; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network of a government or private entity 
or utility or any information stored on, 
processed on, or transiting such a system 
or network; 
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work of a government or private entity or 
utility; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network of a govern-
ment or private entity or utility, including 
to gain such unauthorized access for the 
purpose of exfiltrating information stored 
on, processed on, or transiting a system or 
network of a government or private entity 
or utility. 
‘‘(B) EXCLUSION.—Such term does not in-
clude intelligence pertaining to efforts to gain 
unauthorized access to a system or network of 
a government or private entity or utility that 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
solely involve violations of consumer terms of 
service or consumer licensing agreements and 
do not otherwise constitute unauthorized access. 
‘‘(6) CYBERSECURITY
CRIME.—The term ‘cy-
bersecurity crime’ means— 
‘‘(A) a crime under a Federal or State law 
that involves— 
‘‘(i) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work; 
‘‘(ii) efforts to gain unauthorized ac-
cess to a system or network; or 
‘‘(iii) efforts to exfiltrate information 
from a system or network without author-
ization; or 
‘‘(B) the violation of a provision of Federal 
law relating to computer crimes, including a 
violation of any provision of title 18, United 
States Code, created or amended by the Com-
puter Fraud and Abuse Act of 1986 (Public 
Law 99–474). 
‘‘(7) CYBERSECURITY
PROVIDER.—The term 
‘cybersecurity provider’ means a non-Federal entity 
that provides goods or services intended to be used 
for cybersecurity purposes. 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(8) CYBERSECURITY PURPOSE.— 
‘‘(A) IN GENERAL.—The term ‘cybersecu-
rity purpose’ means the purpose of ensuring the 
integrity, confidentiality, or availability of, or 
safeguarding, a system or network, including 
protecting a system or network from— 
‘‘(i) a vulnerability of a system or net-
work; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network or any information stored on, 
processed on, or transiting such a system 
or network; 
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network, including to 
gain such unauthorized access for the pur-
pose of exfiltrating information stored on, 
processed on, or transiting a system or 
network. 
‘‘(B) EXCLUSION.—Such term does not in-
clude the purpose of protecting a system or net-
work from efforts to gain unauthorized access 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
to such system or network that solely involve 
violations of consumer terms of service or con-
sumer licensing agreements and do not other-
wise constitute unauthorized access. 
‘‘(9) CYBERSECURITY SYSTEM.— 
‘‘(A) IN GENERAL.—The term ‘cybersecu-
rity system’ means a system designed or em-
ployed to ensure the integrity, confidentiality, 
or availability of, or safeguard, a system or net-
work, including protecting a system or network 
from— 
‘‘(i) a vulnerability of a system or net-
work; 
‘‘(ii) a threat to the integrity, con-
fidentiality, or availability of a system or 
network or any information stored on, 
processed on, or transiting such a system 
or network; 
‘‘(iii) efforts to deny access to or de-
grade, disrupt, or destroy a system or net-
work; or 
‘‘(iv) efforts to gain unauthorized ac-
cess to a system or network, including to 
gain such unauthorized access for the pur-
pose of exfiltrating information stored on, 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
processed on, or transiting a system or 
network. 
‘‘(B) EXCLUSION.—Such term does not in-
clude a system designed or employed to protect 
a system or network from efforts to gain unau-
thorized access to such system or network that 
solely involve violations of consumer terms of 
service or consumer licensing agreements and 
do not otherwise constitute unauthorized access. 
‘‘(10) INTEGRITY.—The term ‘integrity’ means 
guarding against improper information modification 
or destruction, including ensuring information non-
repudiation and authenticity. 
‘‘(11) PROTECTED
ENTITY.—The term ‘pro-
tected entity’ means an entity, other than an indi-
vidual, that contracts with a cybersecurity provider 
for goods or services to be used for cybersecurity 
purposes. 
‘‘(12) SELF-PROTECTED
ENTITY.—The term 
‘self-protected entity’ means an entity, other than an 
individual, that provides goods or services for cyber-
security purposes to itself. 
‘‘(13) UTILITY.—The term ‘utility’ means an 
entity providing essential services (other than law 
enforcement or regulatory services), including elec-
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
tricity, natural gas, propane, telecommunications, 
transportation, water, or wastewater services.’’. 
(b) PROCEDURES AND GUIDELINES.—The Director 
of National Intelligence shall— 
(1) not later than 60 days after the date of the 
enactment of this Act, establish procedures under 
paragraph (1) of section 1104(a) of the National Se-
curity Act of 1947, as added by subsection (a) of 
this section, and issue guidelines under paragraph 
(3) of such section 1104(a); 
(2) in establishing such procedures and issuing 
such guidelines, consult with the Secretary of Home-
land Security to ensure that such procedures and 
such guidelines permit the owners and operators of 
critical infrastructure to receive all appropriate cyber 
threat intelligence (as defined in section 1104(h)(5) 
of such Act, as added by subsection (a)) in the pos-
session of the Federal Government; and 
(3) following the establishment of such proce-
dures and the issuance of such guidelines, expedi-
tiously distribute such procedures and such guide-
lines to appropriate departments and agencies of the 
Federal Government, private-sector entities, and 
utilities (as defined in section 1104(h)(13) of such 
Act, as added by subsection (a)). 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
(c) PRIVACY AND CIVIL LIBERTIES POLICIES AND 
PROCEDURES.—Not later than 60 days after the date of 
the enactment of this Act, the Director of National Intel-
ligence, in consultation with the Secretary of Homeland 
Security and the Attorney General, shall establish the poli-
cies and procedures required under section 1104(c)(7)(A) 
of the National Security Act of 1947, as added by sub-
section (a) of this section. 
(d) INITIAL REPORTS.—The first reports required to 
be submitted under paragraphs (1) and (2) of subsection 
(e) of section 1104 of the National Security Act of 1947, 
as added by subsection (a) of this section, shall be sub-
mitted not later than 1 year after the date of the enact-
ment of this Act. 
(e) TABLE OF CONTENTS AMENDMENT.—The table 
of contents in the first section of the National Security 
Act of 1947 is amended by adding at the end the following 
new item: 
‘‘Sec. 1104. Cyber threat intelligence and information sharing.’’. 
SEC. 4. SUNSET. 
Effective on the date that is 5 years after the date 
of the enactment of this Act— 
(1) section 1104 of the National Security Act of 
1947, as added by section 2(a) of this Act, is re-
pealed; and 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
(2) the table of contents in the first section of 
the National Security Act of 1947, as amended by 
section 2(d) of this Act, is amended by striking the 
item relating to section 1104, as added by such sec-
tion 2(d). 
SEC. 5. SENSE OF CONGRESS ON INTERNATIONAL CO-
OPERATION. 
It is the sense of Congress that international coopera-
tion with regard to cybersecurity should be encouraged 
wherever possible under this Act and the amendments 
made by this Act. 
SEC. 6. RULE OF CONSTRUCTION RELATING TO CONSUMER 
DATA. 
Nothing in this Act or the amendments made by this 
Act shall be construed to provide new or alter any existing 
authority for an entity to sell personal information of a 
consumer to another entity for marketing purposes. 
SEC. 7. SAVINGS CLAUSE WITH REGARD TO CYBERSECU-
RITY PROVIDER OBLIGATION TO REPORT 
CYBER THREAT INCIDENT INFORMATION TO 
FEDERAL GOVERNMENT. 
Nothing in this Act or the amendments made by this 
Act shall be construed to provide authority to a depart-
ment or agency of the Federal Government to require a 
cybersecurity provider that has contracted with the Fed-
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS
eral Government to provide information services to provide 
information about cybersecurity incidents that do not pose 
a threat to the Federal Government’s information. 
Æ 
VerDate Sep 11 2014 
00:52 Jan 15, 2015
Jkt 049200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6301
E:\BILLS\H234.IH
H234
SSpencer on DSK4SPTVN1PROD with BILLS