IV 113th CONGRESS 1st Session H. RES. 164 In the House of Representatives, U. S., April 17, 2013 RESOLUTION Providing for consideration of the bill (H.R. 624) to provide for the sharing of certain cyber threat intelligence and cyber threat information between the intelligence community and cybersecurity entities, and for other purposes.

That at any time after the adoption of this resolution the Speaker may, pursuant to clause 2(b) of rule XVIII, declare the House resolved into the Committee of the Whole House on the state of the Union for consideration of the bill (H.R. 624) to provide for the sharing of certain cyber threat intelligence and cyber threat information between the intelligence community and cybersecurity entities, and for other purposes. The first reading of the bill shall be dispensed with. All points of order against consideration of the bill are waived. General debate shall be confined to the bill and shall not exceed one hour equally divided and controlled by the chair and ranking minority member of the Permanent Select Committee on Intelligence. After general debate the bill shall be considered for amendment under the five-minute rule. In lieu of the amendment in the nature of a substitute recommended by the Permanent Select Committee on Intelligence now printed in the bill, it shall be in order to consider as an original bill for the purpose of amendment under the five-minute rule an amendment in the nature of a substitute consisting of the text of Rules Committee Print 113–7. That amendment in the nature of a substitute shall be considered as read. All points of order against that amendment in the nature of a substitute are waived. No amendment to that amendment in the nature of a substitute shall be in order except those printed in the report of the Committee on Rules accompanying this resolution. Each such amendment may be offered only in the order printed in the report, may be offered only by a Member designated in the report, shall be considered as read, shall be debatable for the time specified in the report equally divided and controlled by the proponent and an opponent, shall not be subject to amendment, and shall not be subject to a demand for division of the question in the House or in the Committee of the Whole. All points of order against such amendments are waived. At the conclusion of consideration of the bill for amendment the Committee shall rise and report the bill to the House with such amendments as may have been adopted. Any Member may demand a separate vote in the House on any amendment adopted in the Committee of the Whole to the bill or to the amendment in the nature of a substitute made in order as original text. The previous question shall be considered as ordered on the bill and amendments thereto to final passage without intervening motion except one motion to recommit with or without instructions. 2. Notwithstanding any other provision of this resolution, the amendment specified in section 3 shall be in order as though printed as the last amendment in House Report 113–41 if offered by Representative McCaul of Texas or his designee. That amendment shall be debatable for 10 minutes equally divided and controlled by the proponent and an opponent. 3. The amendment referred to in section 2 is as follows: After section 1, insert the following new section (and renumber subsequent sections accordingly): 2. Federal Government coordination with respect to cybersecurity (a) Coordinated activities The Federal Government shall conduct cybersecurity activities to provide shared situational awareness that enables integrated operational actions to protect, prevent, mitigate, respond to, and recover from cyber incidents. (b) Coordinated information sharing (1) Designation of coordinating entity for cyber threat information The President shall designate an entity within the Department of Homeland Security as the civilian Federal entity to receive cyber threat information that is shared by a cybersecurity provider or self-protected entity in accordance with section 1104(b) of the National Security Act of 1947, as added by section 3(a) of this Act, except as provided in paragraph (2) and subject to the procedures established under paragraph (4). (2) Designation of a coordinating entity for cybersecurity crimes The President shall designate an entity within the Department of Justice as the civilian Federal entity to receive cyber threat information related to cybersecurity crimes that is shared by a cybersecurity provider or self-protected entity in accordance with section 1104(b) of the National Security Act of 1947, as added by section 3(a) of this Act, subject to the procedures under paragraph (4). (3) Sharing by coordinating entities The entities designated under paragraphs (1) and (2) shall share cyber threat information shared with such entities in accordance with section 1104(b) of the National Security Act of 1947, as added by section 3(a) of this Act, consistent with the procedures established under paragraphs (4) and (5). (4) Procedures Each department or agency of the Federal Government receiving cyber threat information shared in accordance with section 1104(b) of the National Security Act of 1947, as added by section 3(a) of this Act, shall establish procedures to— (A) ensure that cyber threat information shared with departments or agencies of the Federal Government in accordance with such section 1104(b) is also shared with appropriate departments and agencies of the Federal Government with a national security mission in real time; (B) ensure the distribution to other departments and agencies of the Federal Government of cyber threat information in real time; and (C) facilitate information sharing, interaction, and collaboration among and between the Federal Government; State, local, tribal, and territorial governments; and cybersecurity providers and self-protected entities. (5) Privacy and civil liberties (A) Policies and procedures The Secretary of Homeland Security, the Attorney General, the Director of National Intelligence, and the Secretary of Defense shall jointly establish and periodically review policies and procedures governing the receipt, retention, use, and disclosure of non-publicly available cyber threat information shared with the Federal Government in accordance with section 1104(b) of the National Security Act of 1947, as added by section 3(a) of this Act. Such policies and procedures shall, consistent with the need to protect systems and networks from cyber threats and mitigate cyber threats in a timely manner— (i) minimize the impact on privacy and civil liberties; (ii) reasonably limit the receipt, retention, use, and disclosure of cyber threat information associated with specific persons that is not necessary to protect systems or networks from cyber threats or mitigate cyber threats in a timely manner; (iii) include requirements to safeguard non-publicly available cyber threat information that may be used to identify specific persons from unauthorized access or acquisition; (iv) protect the confidentiality of cyber threat information associated with specific persons to the greatest extent practicable; and (v) not delay or impede the flow of cyber threat information necessary to defend against or mitigate a cyber threat. (B) Submission to Congress The Secretary of Homeland Security, the Attorney General, the Director of National Intelligence, and the Secretary of Defense shall, consistent with the need to protect sources and methods, jointly submit to Congress the policies and procedures required under subparagraph (A) and any updates to such policies and procedures. (C) Implementation The head of each department or agency of the Federal Government receiving cyber threat information shared with the Federal Government under such section 1104(b) shall— (i) implement the policies and procedures established under subparagraph (A); and (ii) promptly notify the Secretary of Homeland Security, the Attorney General, the Director of National Intelligence, the Secretary of Defense, and the appropriate congressional committees of any significant violations of such policies and procedures. (D) Oversight The Secretary of Homeland Security, the Attorney General, the Director of National Intelligence, and the Secretary of Defense shall jointly establish a program to monitor and oversee compliance with the policies and procedures established under subparagraph (A). (6) Information sharing relationships Nothing in this section shall be construed to— (A) alter existing agreements or prohibit new agreements with respect to the sharing of cyber threat information between the Department of Defense and an entity that is part of the defense industrial base; (B) alter existing information-sharing relationships between a cybersecurity provider, protected entity, or self-protected entity and the Federal Government; (C) prohibit the sharing of cyber threat information directly with a department or agency of the Federal Government for criminal investigative purposes related to crimes described in section 1104(c)(1) of the National Security Act of 1947, as added by section 3(a) of this Act; or (D) alter existing agreements or prohibit new agreements with respect to the sharing of cyber threat information between the Department of Treasury and an entity that is part of the financial services sector. (7) Technical assistance (A) Discussions and assistance Nothing in this section shall be construed to prohibit any department or agency of the Federal Government from engaging in formal or informal technical discussion regarding cyber threat information with a cybersecurity provider or self-protected entity or from providing technical assistance to address vulnerabilities or mitigate threats at the request of such a provider or such an entity. (B) Coordination Any department or agency of the Federal Government engaging in an activity referred to in subparagraph (A) shall coordinate such activity with the entity of the Department of Homeland Security designated under paragraph (1) and share all significant information resulting from such activity with such entity and all other appropriate departments and agencies of the Federal Government. (C) Sharing by designated entity Consistent with the policies and procedures established under paragraph (5), the entity of the Department of Homeland Security designated under paragraph (1) shall share with all appropriate departments and agencies of the Federal Government all significant information resulting from— (i) formal or informal technical discussions between such entity of the Department of Homeland Security and a cybersecurity provider or self-protected entity about cyber threat information; or (ii) any technical assistance such entity of the Department of Homeland Security provides to such cybersecurity provider or such self-protected entity to address vulnerabilities or mitigate threats. (c) Reports on information sharing (1) Inspector General of the Department of Homeland Security report The Inspector General of the Department of Homeland Security, in consultation with the Inspector General of the Department of Justice, the Inspector General of the Intelligence Community, the Inspector General of the Department of Defense, and the Privacy and Civil Liberties Oversight Board, shall annually submit to the appropriate congressional committees a report containing a review of the use of information shared with the Federal Government under subsection (b) of section 1104 of the National Security Act of 1947, as added by section 3(a) of this Act, including— (A) a review of the use by the Federal Government of such information for a purpose other than a cybersecurity purpose; (B) a review of the type of information shared with the Federal Government under such subsection; (C) a review of the actions taken by the Federal Government based on such information; (D) appropriate metrics to determine the impact of the sharing of such information with the Federal Government on privacy and civil liberties, if any; (E) a list of the departments or agencies receiving such information; (F) a review of the sharing of such information within the Federal Government to identify inappropriate stovepiping of shared information; and (G) any recommendations of the Inspector General of the Department of Homeland Security for improvements or modifications to the authorities under such section. (2) Privacy and civil liberties officers report The Officer for Civil Rights and Civil Liberties of the Department of Homeland Security, in consultation with the Privacy and Civil Liberties Oversight Board, the Inspector General of the Intelligence Community, and the senior privacy and civil liberties officer of each department or agency of the Federal Government that receives cyber threat information shared with the Federal Government under such subsection (b), shall annually and jointly submit to Congress a report assessing the privacy and civil liberties impact of the activities conducted by the Federal Government under such section 1104. Such report shall include any recommendations the Civil Liberties Protection Officer and Chief Privacy and Civil Liberties Officer consider appropriate to minimize or mitigate the privacy and civil liberties impact of the sharing of cyber threat information under such section 1104. (3) Form Each report required under paragraph (1) or (2) shall be submitted in unclassified form, but may include a classified annex. (d) Definitions In this section: (1) Appropriate congressional committees The term appropriate congressional committees means— (A) the Committee on Homeland Security, the Committee on the Judiciary, the Permanent Select Committee on Intelligence, and the Committee on Armed Services of the House of Representatives; and (B) the Committee on Homeland Security and Governmental Affairs, the Committee on the Judiciary, the Select Committee on Intelligence, and the Committee on Armed Services of the Senate. (2) Cyber threat information, cyber threat intelligence, cybersecurity crimes, cybersecurity provider, cybersecurity purpose, and self-protected entity The terms cyber threat information , cyber threat intelligence , cybersecurity crimes , cybersecurity provider , cybersecurity purpose , and self-protected entity have the meaning given those terms in section 1104 of the National Security Act of 1947, as added by section 3(a) of this Act. (3) Intelligence community The term intelligence community has the meaning given the term in section 3(4) of the National Security Act of 1947 ( 50 U.S.C. 401a(4) ). (4) Shared situational awareness The term shared situational awareness means an environment where cyber threat information is shared in real time between all designated Federal cyber operations centers to provide actionable information about all known cyber threats. . Page 5, strike line 6 and all that follows through page 6, line 7. Page 7, beginning on line 17, strike by the department or agency of the Federal Government receiving such cyber threat information . Page 13, strike line 13 and all that follows through page 15, line 23. Page 17, strike line 15 and all that follows through page 19, line 19.

Karen L. Haas, Clerk.