712 
† HR 5515 EAS 
(2) the Committee on Armed Services, the Com-
mittee on Appropriations, and the Permanent Select 
Committee on Intelligence of the House of Representa-
tives. 
Subtitle C—Cyberspace-related 
Matters 
PART I—CYBERSPACE GENERALLY 
SEC. 1621. POLICY OF THE UNITED STATES ON CYBER-
SPACE, CYBERSECURITY, CYBER WARFARE, 
AND CYBER DETERRENCE. 
(a) IN GENERAL.—It shall be the policy of the United 
States, with respect to matters pertaining to cyberspace, cy-
bersecurity, and cyber warfare, that the United States 
should employ all instruments of national power, including 
the use of offensive cyber capabilities, to deter if possible, 
and respond when necessary, to any and all cyber attacks 
or other malicious cyber activities that target United States 
interests with the intent to— 
(1) cause casualties among United States persons 
or persons of our allies; 
(2) significantly disrupt the normal functioning 
of United States democratic society or government 
(including attacks against critical infrastructure that 
could damage systems used to provide key services to 
the public or government);
713 
† HR 5515 EAS 
(3) threaten the command and control of the 
United States Armed Forces, the freedom of maneuver 
of the United States Armed Forces, or the industrial 
base or other infrastructure on which the United 
States Armed Forces rely to defend United States in-
terests and commitments; or 
(4) achieve an effect, whether individually or in 
aggregate, comparable to an armed attack or imperil 
a vital interest of the United States. 
(b) RESPONSE OPTIONS.—In carrying out the policy 
set forth in subsection (a), the United States shall plan, de-
velop, and demonstrate response options to address the full 
range of potential cyber attacks on United States interests 
that could be conducted by potential adversaries of the 
United States. 
(c) DENIAL OPTIONS.—In carrying out the policy set 
forth in subsection (a) through response options developed 
pursuant to subsection (b), the United States shall, to the 
greatest extent practicable, prioritize the defensibility and 
resiliency against cyber attacks and malicious cyber activi-
ties described in subsection (a) of infrastructure critical to 
the political integrity, economic security, and national se-
curity of the United States. 
(d) COST-IMPOSITION OPTIONS.—In carrying out the 
policy set forth in subsection (a) through response options
714 
† HR 5515 EAS 
developed pursuant to subsection (b), the United States shall 
develop and demonstrate, or otherwise make known to ad-
versaries of the existence of, cyber capabilities to impose 
costs on any foreign power targeting the United States or 
United States persons with a cyber attack or malicious 
cyber activity described in subsection (a). 
(e) MULTI-PRONG RESPONSE.—In carrying out the 
policy set forth in subsection (a) through response options 
developed pursuant to subsection (b), the United States 
shall— 
(1) devote immediate and sustained attention to 
boosting the cyber resilience of critical United States 
strike systems (including cyber, nuclear, and non-nu-
clear systems) in order to ensure the United States 
can credibly threaten to impose unacceptable costs in 
response to even the most sophisticated large-scale 
cyber attack; 
(2) develop offensive cyber capabilities and spe-
cific plans and strategies to put at risk targets most 
valued by adversaries of the United States and their 
key decision makers; 
(3) enhance attribution capabilities to reduce the 
time required to positively attribute an attack with 
high confidence; and
715 
† HR 5515 EAS 
(4) develop intelligence and offensive cyber capa-
bilities to detect, disrupt, and potentially expose mali-
cious cyber activities. 
(f) POLICIES RELATING TO OFFENSIVE CYBER CAPA-
BILITIES AND SOVEREIGNTY.—It is the policy of the United 
States that, when a cyber attack or malicious cyber activity 
transits or otherwise relies upon the networks or infrastruc-
ture of a third country— 
(1) the United States shall, to the greatest extent 
practicable, notify and encourage the government of 
that country to take action to eliminate the threat; 
and 
(2) if the government is unable or unwilling to 
take action, the United States reserves the right to act 
unilaterally (with the consent of that government if 
possible, but without such consent if necessary). 
(g) AUTHORITY OF SECRETARY OF DEFENSE.— 
(1) IN GENERAL.—The Secretary of Defense has 
the authority to develop, prepare, coordinate, and, 
when appropriately authorized to do so, conduct mili-
tary cyber operations in response to cyber attacks and 
malicious cyber activities described in subsection (a) 
that are carried out against the United States or 
United States persons by a foreign power.
716 
† HR 5515 EAS 
(2) DELEGATION
OF
ADDITIONAL
AUTHORI-
TIES.—The Secretary may delegate to the Commander 
of the United States Cyber Command such authorities 
of the Secretaries of the military departments, includ-
ing authorities relating to manning, training, and 
equipping, that the Secretary considers appropriate. 
(3) USE OF DELEGATED AUTHORITIES.—The use 
by the Commander of the United States Cyber Com-
mand of any authority delegated to the Commander 
pursuant to this subsection shall be subject to the au-
thority, direction, and control of the Secretary. 
(4) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall be construed to limit the authority of 
the President or Congress to authorize the use of mili-
tary force. 
(h) FOREIGN POWER DEFINED.—In this section, the 
term ‘‘foreign power’’ has the meaning given that term in 
section 101 of the Foreign Intelligence Surveillance Act of 
1978 (50 U.S.C. 1801). 
SEC. 1622. AFFIRMING THE AUTHORITY OF THE SECRETARY 
OF DEFENSE TO CONDUCT MILITARY ACTIVI-
TIES AND OPERATIONS IN CYBERSPACE. 
Section 130g of title 10, United States Code, is amend-
ed—
717 
† HR 5515 EAS 
(1) by striking ‘‘The Secretary’’ and inserting 
the following: 
‘‘(a) IN GENERAL.—The Secretary’’; 
(2) by adding at the end the following new sub-
sections: 
‘‘(b) AFFIRMATION OF AUTHORITY.—(1) Congress af-
firms that the Secretary of Defense may conduct military 
activities or operations in cyberspace, including clandestine 
military activities or operations in cyberspace, to defend 
the United States and allies and interests of the United 
States, including in response to malicious cyber activity 
carried out against the United States or a United States 
person by a foreign power. 
‘‘(2) Congress affirms that the authority referred to in 
paragraph (1) includes the conduct of military activities 
or operations in cyberspace short of war and in areas out-
side of named areas of conflict for the purpose of prepara-
tion of the environment, influence, force protection, and de-
terrence of hostilities, or counterterrorism operations in-
volving the armed forces of the United States. 
‘‘(c) CLANDESTINE ACTIVITIES OR OPERATIONS.—A 
clandestine military activity or operation in cyberspace 
shall be considered a traditional military activity for the 
purposes of section 503(e)(2) of the National Security Act 
of 1947 (50 U.S.C. 3093(e)(2)).