purpose for which such information is 
shared; and 
‘‘(v) shall be handled by the Federal 
Government consistent with the need to pro-
tect sources and methods and the national 
security of the United States; and 
‘‘(E) shall be exempt from disclosure under 
a State, local, or tribal law or regulation that re-
quires public disclosure of information by a pub-
lic or quasi-public entity. 
‘‘(4) EXEMPTION FROM LIABILITY.— 
‘‘(A) EXEMPTION.—No civil or criminal 
cause of action shall lie or be maintained in 
Federal or State court against a protected entity, 
self-protected entity, cybersecurity provider, or 
an officer, employee, or agent of a protected enti-
ty, self-protected entity, or cybersecurity pro-
vider, acting in good faith— 
‘‘(i) for using cybersecurity systems to 
identify or obtain cyber threat information 
or for sharing such information in accord-
ance with this section; or 
‘‘(ii) for decisions made for cybersecu-
rity purposes and based on cyber threat in-
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
formation identified, obtained, or shared 
under this section. 
‘‘(B) LACK OF GOOD FAITH.—For purposes 
of the exemption from liability under subpara-
graph (A), a lack of good faith includes, but is 
not limited to, any act or omission taken with 
intent to injure, defraud, or otherwise endanger 
any individual, government entity, private enti-
ty, or utility. 
‘‘(5) RELATIONSHIP TO OTHER LAWS REQUIRING 
THE DISCLOSURE OF INFORMATION.—The submission 
of information under this subsection to the Federal 
Government shall not satisfy or affect— 
‘‘(A) any requirement under any other pro-
vision of law for a person or entity to provide 
information to the Federal Government; or 
‘‘(B) the applicability of other provisions of 
law, including section 552 of title 5, United 
States Code (commonly known as the ‘Freedom 
of Information Act’), with respect to information 
required to be provided to the Federal Govern-
ment under such other provision of law. 
‘‘(6) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall be construed to provide new authority 
to— 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(A) a cybersecurity provider to use a cy-
bersecurity system to identify or obtain cyber 
threat information from a system or network 
other than a system or network owned or oper-
ated by a protected entity for which such cyberse-
curity provider is providing goods or services for 
cybersecurity purposes; or 
‘‘(B) a self-protected entity to use a cyberse-
curity system to identify or obtain cyber threat 
information from a system or network other than 
a system or network owned or operated by such 
self-protected entity. 
‘‘(c) FEDERAL GOVERNMENT USE OF INFORMATION.— 
‘‘(1) LIMITATION.—The Federal Government 
may use cyber threat information shared with the 
Federal Government in accordance with subsection 
(b)— 
‘‘(A) for cybersecurity purposes; 
‘‘(B) for the investigation and prosecution 
of cybersecurity crimes; 
‘‘(C) for the protection of individuals from 
the danger of death or serious bodily harm and 
the investigation and prosecution of crimes in-
volving such danger of death or serious bodily 
harm; or 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(D) for the protection of minors from child 
pornography, any risk of sexual exploitation, 
and serious threats to the physical safety of mi-
nors, including kidnapping and trafficking and 
the investigation and prosecution of crimes in-
volving child pornography, any risk of sexual ex-
ploitation, and serious threats to the physical 
safety of minors, including kidnapping and traf-
ficking, and any crime referred to in section 
2258A(a)(2) of title 18, United States Code. 
‘‘(2) AFFIRMATIVE SEARCH RESTRICTION.—The 
Federal Government may not affirmatively search 
cyber threat information shared with the Federal 
Government under subsection (b) for a purpose other 
than a purpose referred to in paragraph (1). 
‘‘(3) ANTI-TASKING
RESTRICTION.—Nothing in 
this section shall be construed to permit the Federal 
Government to— 
‘‘(A) require a private-sector entity or util-
ity to share information with the Federal Gov-
ernment; or 
‘‘(B) condition the sharing of cyber threat 
intelligence with a private-sector entity or utility 
on the provision of cyber threat information to 
the Federal Government. 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(4) PROTECTION OF SENSITIVE PERSONAL DOC-
UMENTS.—The Federal Government may not use the 
following information, containing information that 
identifies a person, shared with the Federal Govern-
ment in accordance with subsection (b) unless such 
information is used in accordance with the policies 
and procedures established under paragraph (7): 
‘‘(A) Library circulation records. 
‘‘(B) Library patron lists. 
‘‘(C) Book sales records. 
‘‘(D) Book customer lists. 
‘‘(E) Firearms sales records. 
‘‘(F) Tax return records. 
‘‘(G) Educational records. 
‘‘(H) Medical records. 
‘‘(5) NOTIFICATION OF NON-CYBER THREAT IN-
FORMATION.—If a department or agency of the Fed-
eral Government receiving information pursuant to 
subsection (b)(1) determines that such information is 
not cyber threat information, such department or 
agency shall notify the entity or provider sharing 
such information pursuant to subsection (b)(1). 
‘‘(6) RETENTION AND USE OF CYBER THREAT IN-
FORMATION.—No department or agency of the Federal 
Government shall retain or use information shared 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS
pursuant to subsection (b)(1) for any use other than 
a use permitted under subsection (c)(1). 
‘‘(7) PRIVACY AND CIVIL LIBERTIES.— 
‘‘(A) POLICIES AND PROCEDURES.—The Di-
rector of National Intelligence, in consultation 
with the Secretary of Homeland Security and 
the Attorney General, shall establish and periodi-
cally review policies and procedures governing 
the receipt, retention, use, and disclosure of non- 
publicly available cyber threat information 
shared with the Federal Government in accord-
ance with subsection (b)(1). Such policies and 
procedures shall, consistent with the need to pro-
tect systems and networks from cyber threats and 
mitigate cyber threats in a timely manner— 
‘‘(i) minimize the impact on privacy 
and civil liberties; 
‘‘(ii) reasonably limit the receipt, re-
tention, use, and disclosure of cyber threat 
information associated with specific persons 
that is not necessary to protect systems or 
networks from cyber threats or mitigate 
cyber threats in a timely manner; 
‘‘(iii) include requirements to safe-
guard non-publicly available cyber threat 
VerDate Mar 15 2010 
22:24 Apr 15, 2013
Jkt 029200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H624.RH
H624
tkelley on DSK3SPTVN1PROD with BILLS