In this task, you are given text for US Congressional and California state bills, your task is to generate a summary for this bill.

[Q]: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Drug Use Prevention Act of 1997''.

SEC. 2. DEFINITION OF ``RECOMMEND''.

    Section 102 of the Controlled Substances Act (21 U.S.C. 802) is 
amended by adding at the end the following:
            ``(47) A practitioner will be deemed to have `recommended' 
        the use of marihuana if the practitioner offered advice, or 
        responded to a request for advice, suggesting the use of 
        marihuana while acting in the course of his or her professional 
        capacity.''.

SEC. 3. DENIAL OR REVOCATION OF REGISTRATION.

    (a) Denial of Registration.--Section 303(f) of the Controlled 
Substances Act (21 U.S.C. 823(f)) is amended--
            (1) by redesignating paragraphs (1) through (5) as 
        subclauses (I) through (V), respectively, and indenting 
        accordingly;
            (2) by striking ``(f) The Attorney General'' and inserting 
        the following:
    ``(f) Registration of Practitioners to Dispense or Conduct Research 
With Controlled Substances.--
            ``(1) In general.--Subject to paragraph (2), the Attorney 
        General'';
            (3) in the second sentence, by striking ``The Attorney'' 
        and inserting the following:
            ``(2) Denial of registration.--
                    ``(A) Discretionary denial of application.--
                            ``(i) In general.--The Attorney'';
            (4) in the third sentence, by striking ``In determining the 
        public interest'' and inserting the following:
                            ``(ii) Determination of public interest.--
                        In determining the public interest for purposes 
                        of clause (i)'';
            (5) in the undesignated paragraph following subclause (V), 
        as redesignated by paragraph (1) of this subsection, by 
        striking ``Separate registration'' and inserting the following:
            ``(3) Registration for research purposes.--Separate 
        registration''; and
            (6) by adding at the end of paragraph (2), as so designated 
        by paragraph (3) of this subsection, the following:
                    ``(B) Mandatory denial of application.--The 
                Attorney General shall deny an application for 
                registration under this subsection upon a finding by 
                the Attorney General that the applicant practitioner--
                            ``(i) administered, dispensed, or 
                        recommended the use of marihuana to an 
                        individual in violation of Federal or State 
                        law; or
                            ``(ii) has been excluded (or directed to be 
                        excluded) from participation in a program 
                        pursuant to section 1128(a)(5) of the Social 
                        Security Act (42 U.S.C. 1320a-7(a)(5)).''.
    (b) Revocation of Registration.--Section 304(a) of the Controlled 
Substances Act (21 U.S.C. 824(a)) is amended--
            (1) in subsection (a)--
                    (A) by redesignating paragraphs (1) through (5) as 
                subparagraphs (A) through (E), respectively, and 
                indenting accordingly;
                    (B) by striking ``(a) A registration'' and 
                inserting ``(a)(1) Subject to paragraph (3), a 
                registration''; and
                    (C) in the undesignated paragraph following 
                subparagraph (E), as redesignated, by striking ``A 
                registration'' and inserting the following:
            ``(2) Revocation of registration to dispense a narcotic 
        drug.--A registration'';
                and
            (2) by adding at the end the following:
            ``(3) Mandatory revocation of registration.--The Attorney 
        General shall revoke a registration described in paragraph (1) 
        upon a finding by the Attorney General that the registrant--
                    ``(A) administered, dispensed, or recommended the 
                use of marihuana to an individual in violation of 
                Federal or State law; or
                    ``(B) has been excluded (or directed to be 
                excluded) from participation in a program pursuant to 
                section 1128(a)(5) of the Social Security Act (42 
                U.S.C. 1320a-7(a)(5)).''.

SEC. 4. PROHIBITED ACTS RELATING TO MARIHUANA.

    Section 403(a) of the Controlled Substances Act (21 U.S.C. 843(a)) 
is amended--
            (1) in paragraph (3), by inserting before the semicolon ``, 
        including acquiring or obtaining possession of marihuana by 
        means of claiming a medical need, with the intent of selling or 
        distributing the marihuana'';
            (2) in paragraph (8), by striking ``or'' at the end;
            (3) in paragraph (9), by striking the period at the end and 
        inserting ``; or''; and
            (4) by adding at the end the following:
            ``(10) if that person is a practitioner, to prescribe, 
        dispense, or recommend the use of marihuana.''.

SEC. 5. ENHANCED PENALTIES RELATING TO MARIHUANA.

    Section 403 of the Controlled Substances Act (21 U.S.C. 843) is 
amended by adding at the end the following:
    ``(g) In addition to any other applicable penalty, any practitioner 
who violates this section by prescribing, dispensing, or recommending 
the use of marihuana to a person under 21 years of age shall be 
sentenced to a term of imprisonment of not more than 8 years, a fine of 
not more than $60,000, or both.''.

SEC. 6. EXCLUSION OF CERTAIN INDIVIDUALS AND ENTITIES FROM 
              PARTICIPATION IN MEDICARE AND STATE HEALTH CARE PROGRAMS 
              FOR ILLEGALLY DISPENSING MARIHUANA.

    Section 1128(a) of the Social Security Act (42 U.S.C. 1320a-7(a)) 
is amended by adding at the end the following:
            ``(5)(A) Any person (including an organization, agency, or 
        other entity, but excluding a beneficiary, as defined in 
        subsection 1128A(i)(5)) that administers, dispenses, or 
        recommends the use of marihuana to an individual in violation 
        of a Federal or State law.
            ``(B) In this paragraph, the terms `administer', 
        `dispense', `recommend', and `marihuana' have the same meanings 
        as in section 102 of the Controlled Substances Act (21 U.S.C. 
        802)).''.
[A]: Drug Use Prevention Act of 1997 - Amends:  (1) the Social Security Act to exclude individuals and entities from participation in Medicare and State health care programs (participation) for administering, dispensing, or recommending the use of marihuana to an individual in violation of Federal or State law; and (2) the Controlled Substances Act (CSA) to direct the Attorney General to deny an application for registration, or revoke a registration, of a practitioner to dispense, or conduct research with, controlled substances upon a finding by the Attorney General that the applicant practitioner administered, dispensed, or recommended the use of marihuana to an individual in violation of Federal or State law or that the applicant practitioner has been excluded (or directed to be excluded) from participation for illegally dispensing marihuana. 
Deems a practitioner to have "recommended" the use of marihuana if he or she offered advice, or responded to a request for advice, suggesting the use of marihuana while acting in the course of his or her professional capacity. 
Amends the CSA to prohibit:  (1) an individual from acquiring or obtaining possession of marihuana by means of claiming a medical need, with the intent of selling or distributing the marihuana; and (2) a practitioner from prescribing, dispensing, or recommending the use of marihuana. 
Directs that, in addition to any other applicable penalty, any practitioner who violates the CSA by prescribing, dispensing, or recommending the use of marihuana to a person under age 21 be sentenced to up to eight years' imprisonment, fined up to $60,000, or both.


[Q]: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Medical Device Cybersecurity Act of 
2017''.

SEC. 2. CYBERSECURITY FOR MEDICAL DEVICES.

    (a) In General.--Chapter V of the Federal Food, Drug, and Cosmetic 
Act (21 U.S.C. 351 et seq.) is amended by inserting after section 520 
(21 U.S.C. 360j) the following--

``SEC. 520A. CYBERSECURITY FOR DEVICES.

    ``(a) Definitions.--In this section:
            ``(1) Cyber device.--The term `cyber device' means any 
        device that has network or Internet connectivity (such as near 
        field communication (NFC), Bluetooth, or WiFi), connects to an 
        external storage device or external media (such as a universal 
        serial bus (USB) or a compact disk), or has any other cyber 
        capability.
            ``(2) Cybersecurity fix or update.--The term `cybersecurity 
        fix or update' means any modification to a cyber device that 
        addresses a software, firmware, or hardware error or known 
        vulnerability, or a security update, and does not change the 
        therapeutic or diagnostic function of the device.
    ``(b) Transparency of Risk Prior to Marketing.--
            ``(1) Report card.--
                    ``(A) In general.--The Secretary, in coordination 
                with the entities described in subparagraph (B), shall 
                develop a report card for indicating the cybersecurity 
                functions of cyber devices. The report card shall 
                contain the contents described in paragraph (2) and be 
                disclosed in accordance with paragraph (3).
                    ``(B) Coordination.--The entities described in this 
                subparagraph are the following:
                            ``(i) The National Institute of Standards 
                        and Technology.
                            ``(ii) The Secretary of Homeland Security.
                            ``(iii) The National Coordination Office 
                        supporting the Networking and Information 
                        Technology Research and Development Program.
                            ``(iv) The Federal Trade Commission.
                            ``(v) Any other relevant agency, or 
                        cybersecurity or medical device industry group, 
                        as determined by the Secretary.
            ``(2) Contents of report card.--Each report card shall 
        contain each of the following:
                    ``(A) Information pertaining to all essential 
                elements described in the most recent version of the 
                Manufacturer Disclosure Statement for Medical Device 
                Security, as set forth by the Healthcare Information 
                and Management Systems Society and the National 
                Electrical Manufacturers Association.
                    ``(B) A traceability matrix, accepted by the 
                Secretary, that--
                            ``(i) redacts content that is confidential, 
                        as determined by the Secretary; and
                            ``(ii) establishes design components and 
                        traces such components to design compensating 
                        controls.
                    ``(C) A description of any manufacturer 
                compensating controls that--
                            ``(i) effectively address known common 
                        vulnerabilities and exposures; and
                            ``(ii) provide providers with industry 
                        standard compensating controls for improving 
                        cybersecurity.
                    ``(D) A description of--
                            ``(i) any cybersecurity evaluation 
                        conducted on the device, including any testing, 
                        validation, or verification of the device;
                            ``(ii) who conducted such evaluation; and
                            ``(iii) the results of such evaluation.
                    ``(E) A cybersecurity risk assessment conducted by 
                the manufacturer, or a third party, explaining the risk 
                of the device to patient safety and clinical hazards.
                    ``(F) An indication of whether the device is 
                capable of being remotely accessed. If the device is 
                capable of being remotely accessed, an indication of 
                any security measures and access protocols the device 
                has in place to secure such access.
            ``(3) Disclosure of report card.--
                    ``(A) Clearance or approval.--The manufacturer of 
                any cyber device shall include the report card in any 
                notification to the Secretary under section 510(k) or 
                any application for premarket approval under section 
                515(c), as applicable.
                    ``(B) Public accessibility.--
                            ``(i) In general.--The Secretary shall 
                        provide a copy of the report card to any entity 
                        described in clause (ii) that submits a request 
                        for such copy to the Secretary.
                            ``(ii) Entities permitted access.--An 
                        entity described in this clause is--
                                    ``(I) any health care industry 
                                entity, consisting of any provider, 
                                device manufacturer, the Federal 
                                Government, health care information 
                                security researchers, and health care 
                                academia; and
                                    ``(II) any entity determined by the 
                                Secretary to have a valid interest in 
                                the report card.
                    ``(C) Updated report card.--For as long as the 
                cyber device receives technical support from the 
                manufacturer or any other third party authorized by the 
                manufacturer, the manufacturer shall submit to the 
                Secretary an annual update to the report card.
    ``(c) Protecting Remote Access to Managed Solutions.--
            ``(1) In general.--A manufacturer of a cyber device shall:
                    ``(A) In order to remotely access such device after 
                selling, or otherwise transferring ownership of, the 
                device, obtain consent for such access from the 
                provider owning or operating the device and from any 
                patient on which the device is used. Such consent may 
                be in the form of an agreement entered into between the 
                provider and the manufacturer at the time the device is 
                sold to the provider, and may be for the manufacturer 
                to remotely access the device at times specified in 
                such agreement or by an agreement between the 
                manufacturer and provider entered into thereafter. In 
                the case of an agreement described in the previous 
                sentence, consent of the patient may be obtained 
                through the provider notifying the patient of such 
                agreement.
                    ``(B) For any cyber device that the manufacturer 
                may remotely access in accordance with subparagraph 
                (A):
                            ``(i) Notify the provider when the 
                        manufacturer accesses the device remotely, 
                        including the name of the person with such 
                        access, the kinds of tasks that can be 
                        performed through such access, and the software 
                        used to access the device. Such notification 
                        can be in the form of an audit log described in 
                        clause (ii) if the audit log is readily 
                        available to the provider.
                            ``(ii) Maintain an audit log for each time 
                        the manufacturer accesses the device remotely 
                        and make such log accessible to the provider.
                    ``(C) Except as provided in paragraph (2), for any 
                cyber device that has the capability to be accessed 
                remotely by the manufacturer or any other entity:
                            ``(i) Implement multi-factor authentication 
                        for accessing any cyber capability of the 
                        device.
                            ``(ii) Secure data in motion and data at 
                        rest with data encryption, and other best 
                        practices, approved by the National Institute 
                        of Standards and Technology.
                            ``(iii) Install automated tools to track 
                        access, or identify attempts at unauthorized 
                        access, to any cyber capability of the device.
                            ``(iv) Adopt whitelisting approaches and 
                        changeable passwords for accessing any cyber 
                        capability of the device.
                            ``(v) Comply with the remote access 
                        provisions recommended by the National 
                        Institute of Standards and Technology, in the 
                        document entitled `Security for Telecommuting 
                        and Broadband Communications (NIST Special 
                        Publication 800-46)', published in August 2002.
            ``(2) Exceptions.--A manufacturer may submit a petition to 
        the Secretary to exempt a cyber device from any requirement 
        under paragraph (1)(C). The Secretary may grant such an 
        exemption if it determines that the manufacturer can prove the 
        exemption would pose not more than a minimal risk to patient 
        health, minimal risk to privacy, and minimal risk of a cyber 
        vulnerability.
    ``(d) Cybersecurity Fixes or Updates.--
            ``(1) Re-clearance or reapproval.--Unless at the request of 
        the Secretary due to a unique and extenuating circumstance, any 
        cybersecurity fix or update shall not require a new 
        notification under section 510(k) or application for premarket 
        approval under section 515(c).
            ``(2) Free cybersecurity fixes or updates.--A manufacturer 
        of a cyber device shall provide any cybersecurity fix or update 
        to the device free of charge until--
                    ``(A) the date on which any agreement to provide 
                such fixes or updates, entered into between the 
                manufacturer (or a third party authorized by the 
                manufacturer) and a provider, expires; or
                    ``(B) if no agreement described in subparagraph (A) 
                is in effect, the date that is 10 years after the date 
                on which the manufacturer discontinues marketing the 
                device.
    ``(e) End-of-Life Device.--Not later than 90 days after a 
manufacturer declares that it will no longer sell a cyber device, the 
manufacturer of such device shall--
            ``(1) shall provide any provider owning or operating the 
        device with the report card, as most recently updated under 
        subsection (b)(3)(C);
            ``(2) to the extent practicable, inform any provider owning 
        or operating the device that the manufacturer will no longer be 
        manufacturing such device;
            ``(3) provide notice to any provider owning or operating 
        the device of the date on which the last cybersecurity fix or 
        update will be provided by the manufacturer;
            ``(4) notify the Secretary of such declaration; and
            ``(5) provide any provider owning or operating the device 
        with the following information related to the device:
                    ``(A) Compensating controls on how to securely 
                configure the cyber device if the device stays in 
                operation past the date on which the manufacturer stops 
                providing cybsecurity fixes or updates under subsection 
                (d)(2).
                    ``(B) Documentation on secure preparation for 
                recycling and disposal of the device.
                    ``(C) Specific guidance regarding supporting 
                infrastructure architecture, including network 
                segmentation and device isolation requirements.
                    ``(D) Instructions on how to delete any personally 
                identifiable information, protected health information, 
                or other site-specific sensitive data such as 
                configuration files.
    ``(f) Applicability.--This section shall not apply with respect to 
any cyber device for which, prior to the enactment of the Medical 
Device Cybersecurity Act of 2017, a notification was submitted under 
section 510(k), or for which an application for premarket approval was 
submitted under section 515(c).''.
    (b) Enforcement.--Section 301 of the Federal Food, Drug, and 
Cosmetic Act (21 U.S.C. 331) is amended by adding at the end the 
following:
    ``(eee) The failure to comply with subsection (b), (c), (d), or (e) 
of section 520A.''.
    (c) Expansion of ICS-CERT Responsibilities.--
            (1) Definitions.--In this subsection:
                    (A) Cyber device.--The term ``cyber device'' has 
                the meaning given the term in section 520A of the 
                Federal Food, Drug, and Cosmetic Act, as added by 
                subsection (a).
                    (B) ICS-CERT.--The term ``ICS-CERT'' means the 
                Industrial Control Systems Cyber Emergency Response 
                Team of the National Cybersecurity and Communications 
                Integration Center established under section 227 of the 
                Homeland Security Act of 2002 (6 U.S.C. 148).
                    (C) Under secretary.--The term ``Under Secretary'' 
                means the Under Secretary appointed under section 
                103(a)(1)(H) of the Homeland Security Act of 2002 (6 
                U.S.C. 113(a)(1)(H)).
            (2) Expansion.--Not later than 180 days after the date of 
        enactment of this Act, the Under Secretary shall expand the 
        duties and mission of ICS-CERT to include--
                    (A) investigating cybersecurity vulnerabilities of 
                cyber devices that may cause harm to human life or 
                significant misuse of personal health information, as 
                determined necessary by ICS-CERT or at the request of 
                the Under Secretary; and
                    (B) coordinating device-specific responses to 
                cybersecurity incidents and vulnerabilities with 
                respect to cyber devices.
            (3) Consultation.--In carrying out paragraph (2), the Under 
        Secretary shall consult with relevant agencies within the Food 
        and Drug Administration, the Department of Health and Human 
        Services, the National Institute of Standards and Technology, 
        the National Coordination Office for Networking and Information 
        Technology Research and Development, the Federal Trade 
        Commission, and experts in the cybersecurity and medical device 
        industries.
            (4) Coordinated disclosure.--Not later than 6 months after 
        the date of enactment of this Act, the Secretary of Homeland 
        Security shall issue rules relating to the coordinated 
        disclosure of controlled and uncontrolled cybersecurity 
        vulnerabilities of cyber devices, which shall--
                    (A) outline the roles and responsibilities of ICS-
                CERT and manufacturers and providers of cyber devices;
                    (B) provide timelines for all required actions; and
                    (C) provide for the enforcement of cooperation 
                between ICS-CERT and manufacturers and providers of 
                cyber devices.
            (5) Report.--Not later than 1 year after the date of 
        enactment of this Act, the Under Secretary shall submit to 
        Congress a report detailing the expanded duties and mission of 
        ICS-CERT under paragraph (2).
[A]: Medical Device Cybersecurity Act of 2017 This bill amends the Federal Food, Drug, and Cosmetic Act to require the Food and Drug Administration (FDA), in coordination with others,&nbsp;to create a cybersecurity report card for devices that have network or Internet connectivity, connect to an external drive or external media, or have any other cyber capability. Report cards must contain specified information, including: (1) information pertaining to the essential elements described in the most recent version of the Manufacturer Disclosure Statement for Medical Device Security, (2) a cybersecurity risk assessment conducted by the manufacturer or third party, and (3) whether the device is capable of being accessed remotely. A cyber device manufacturer must include&nbsp;a report card in any premarket notification or application for premarket approval. The&nbsp;FDA shall provide a copy of a device's report card&nbsp;if requested&nbsp;by a health care industry entity or an entity with a valid interest in the report card.&nbsp; The bill establishes procedures, including notifications to&nbsp;providers and patients,&nbsp;for manufacturers&nbsp;when cyber devices are&nbsp;remotely accessed or no longer going to be sold. Fixes and updates to cyber devices must be free of charge for specified time periods. The bill expands the responsibilities of the Department of Homeland Security's&nbsp;Industrial Control Systems Cyber Emergency Response Team to include investigating cybersecurity vulnerabilities of cyber devices that may cause harm to human life or the significant misuse of personal health information, and coordinating device-specific responses.


[Q]: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Netizens Protection Act of 1999''.

SEC. 2. PROHIBITION OF INITIATION OF TRANSMISSION OF UNSOLICITED 
              ELECTRONIC MAIL.

    (a) In General.--No person may initiate, or cause to be initiated, 
the transmission of an unsolicited electronic mail message in or 
affecting interstate or foreign commerce if the message--
            (1) does not contain the name, physical address, and 
        electronic mail address of the person who initiates the 
        transmission of the message;
            (2) does not provide an electronic method by which the 
        recipient of the message can contact the person who initiated 
        the transmission of the message to request that no further such 
        messages be sent, which method may include electronic mail or 
        Internet access; or
            (3)(A) is part of a bulk transmission of such messages; and
            (B) includes information that is located in the subject 
        line of the message and is false or misleading with respect to 
        the body of the message.
    (b) Treatment of State Laws.--Subsection (a) may not be construed 
to preempt any State law relating to unsolicited commercial electronic 
mail.
    (c) Private Right of Action.--
            (1) Cause of action.--Any person adversely affected by a 
        violation of subsection (a) may, within 1 year after discovery 
        of the violation, bring a civil action against a person who 
        violates such subsection in a district court of the United 
        States or in any other court of competent jurisdiction, for the 
        district or jurisdiction in which the unsolicited electronic 
        mail message was received or in which the defendant is located.
            (2) Relief.--In a civil action under this subsection, the 
        court may--
                    (A) grant temporary and final injunctions on such 
                terms as it may deem reasonable to prevent or restrain 
                violations of subsection (a);
                    (B) award damages as described in paragraph (3); 
                and
                    (C) direct the recovery of full costs, including 
                awarding reasonable attorneys' fees to an aggrieved 
                party who prevails.
            (3) Damages.--
                    (A) Amount.--The amount of damages in an action 
                under this subsection for a violation of subsection (a) 
                may not exceed $500 for each unsolicited electronic 
                mail message the transmission of which was initiated in 
                violation of such subsection. The court shall treble 
                the amount recovered under the preceding sentence for 
                any transmission of an unsolicited electronic mail 
                message to the aggrieved party in violation of 
                subsection (a) that the court finds was initiated after 
                the aggrieved party contacted the initiator of the 
                transmission to request that the initiator not initiate 
                further transmissions of such mail to such person.
                    (B) Relationship to other damages.--Damages awarded 
                under this paragraph for a violation under subsection 
                (a) are in addition to any other damages awardable for 
                the violation under any other provision of law.

SEC. 3. RESTRICTIONS AGAINST USE OF INTERACTIVE COMPUTER SERVICES TO 
              INITIATE UNSOLICITED ELECTRONIC MAIL.

    (a) Statement of Policy.--Each interactive computer service 
provider shall make available to each customer of the interactive 
computer servicer of the provider the policy of the provider regarding 
unsolicited electronic mail, including any option the provider may have 
for the customer to elect to receive or not to receive unsolicited 
electronic mail and any other options customers may exercise to 
restrict the receipt of unsolicited electronic mail. Such policy shall 
be set forth in writing, in clear and understandable language, in the 
agreement for the provision of the interactive computer service by the 
customer.
    (b) Violation of Policy Against Bulk Mail.--No customer of an 
interactive computer service provider may use the equipment or 
facilities of the provider to initiate, or cause to be initiated, the 
bulk transmission of an unsolicited electronic mail message if the 
policy referred to in subsection (a) of the provider prohibits the 
initiation of such bulk transmissions.
    (c) Cause of Action.--
            (1) In general.--In addition to any other remedies 
        available under any other provision of law, any interactive 
        computer service provider adversely affected by a violation of 
        subsection (b) may bring a civil action in a district court of 
        the United States against a person who violates such 
        subsection.
            (2) Relief.--
                    (A) In general.--An action may be brought under 
                paragraph (1) to enjoin a violation of subsection (b), 
                to obtain damages as specified in subparagraph (B), or 
                to obtain such further and other relief as the court 
                considers appropriate.
                    (B) Damages.--The amount of damages in an action 
                under this subsection for a violation of subsection (b) 
                may not exceed $500 for each unsolicited electronic 
                mail message the transmission of which was initiated in 
                violation of such subsection.
                    (C) Relationship to other damages.--Damages awarded 
                under this paragraph for a violation of subsection (b) 
                are in addition to any other damages awardable for the 
                violation under any other provision of law.
                    (D) Cost and fees.--The court may, in issuing any 
                final order in any action brought under this 
                subsection, award costs of suit, reasonable costs of 
                obtaining service of process, reasonable attorney fees, 
                and expert witness fees for the prevailing party.
            (3) Venue; service of process.--Any civil action brought 
        under this subsection in a district court of the United States 
        may be brought in the district in which the defendant or in 
        which the interactive computer service provider is located, is 
        an inhabitant, or transacts business or wherever venue is 
        proper under section 1391 of title 28, United States Code. 
        Process in such an action may be served in any district in 
        which the defendant is an inhabitant or in which the defendant 
        may be found.

SEC. 4. PROTECTION OF INTERACTIVE COMPUTER SERVICE PROVIDERS.

    (a) In General.--An interactive computer service provider who, in 
good faith, takes action to restrict or prevent the receipt of 
unsolicited electronic mail by its customers shall not be liable for 
any harm resulting from failure to prevent such receipt.
    (b) Rule of Construction.--Subsection (a) may not be construed to 
prevent or restrict the liability of any interactive computer service 
provider for any failure to provide any services other than restriction 
or prevention for customers of receipt of unsolicited electronic mail.

SEC. 5. DEFINITIONS.

    For purposes of this Act, the following definitions shall apply:
            (1) Bulk.--The term ``bulk'' means, with respect to the 
        transmission of an electronic mail message, the transmission, 
        within a 7-day period, of such a message or messages that are 
        identical or substantially similar to 50 or more intended 
        recipients.
            (2) Initiate the transmission.--The term ``initiate the 
        transmission'' means, with respect to an electronic mail, to 
        originate the message, and does not include the actions of any 
        interactive computer service whose facilities or services are 
        used only to relay, handle, or otherwise retransmit the 
        message.
            (3) Interactive computer service.--The term ``interactive 
        computer service'' has the meaning given such term in section 
        230(e) of the Communications Act of 1934 (47 U.S.C. 230(e)).
            (4) Interactive computer service provider.--The term 
        ``interactive computer service provider'' means the provider of 
        an interactive computer service.
            (5) Recipient.--The term ``recipient'' means, with respect 
        to an electronic mail message, an individual electronic mail 
        address to which the message is directed, without regard to 
        whether such address corresponds to a person, computer, list 
        server, or other automated electronic device.
            (6) Unsolicited electronic mail.--The term ``unsolicited 
        electronic mail'' means electronic mail unless such mail is 
        transmitted (A) to any person with that person's prior express 
        invitation or permission, or (B) to any person with whom the 
        sender has an established business or personal relationship.

SEC. 6. EFFECTIVE DATE.

    This Act shall take effect upon the expiration of the 60-day period 
beginning on the date of the enactment of this Act and shall apply to 
transmissions of electronic mail initiated after the expiration of such 
period.
[A]:
Requires each interactive computer service provider to make available to each of its customers its policy regarding unsolicited e-mail, including options for the customer to elect to receive or not receive such e-mail. Prohibits customers from using the equipment or facilities of the provider to initiate the bulk transmission of an unsolicited e-mail message if the provider's policy prohibits such bulk transmissions. Provides a right of action for providers adversely affected by customer violations of such prohibition.
States that a provider who in good faith takes action to restrict or prevent the receipt of unsolicited e-mail by its customers shall not be liable for any harm resulting from the failure to prevent such receipt.