Cyber Intelligence Sharing and Protection Act - Amends the National Security Act of 1947 to add provisions concerning cyber threat intelligence and information sharing. Defines "cyber threat intelligence" as intelligence in the possession of an element of the intelligence community directly pertaining to: (1) a vulnerability of a system or network of a government or private entity; (2) a threat to the integrity, confidentiality, or availability of such a system or network or any information stored on, processed on, or transiting such a system or network; (3) efforts to deny access to or degrade, disrupt, or destroy such a system or network; or (4) efforts to gain unauthorized access to such a system or network, including for the purpose of exfiltrating information. Excludes intelligence pertaining to efforts to gain unauthorized access to such a system or network that solely involve violations of consumer terms of service or consumer licensing agreements and do not otherwise constitute unauthorized access.
Requires the Director of National Intelligence (DNI) to: (1) establish procedures to allow intelligence community elements to share cyber threat intelligence with private-sector entities and utilities, and (2) encourage the sharing of such intelligence.
Requires the procedures established to ensure that such intelligence is only: (1) shared with certified entities or a person with an appropriate security clearance, (2) shared consistent with the need to protect U.S. national security, and (3) used in a manner that protects such intelligence from unauthorized disclosure. Provides for guidelines for the granting of security clearance approvals to certified entities or officers or employees of such entities. Prohibits a certified entity receiving such intelligence from further disclosing the information to any entity other than another certified entity or a federal department or agency authorized to receive such intelligence.
Authorizes a cybersecurity provider (a non-governmental entity that provides goods or services intended to be used for cybersecurity purposes), with the express consent of a protected entity (an entity that contracts with a cybersecurity provider) to: (1) use cybersecurity systems to identify and obtain cyber threat information in order to protect the rights and property of the protected entity; and (2) share cyber threat information with any other entity designated by the protected entity, including the federal government. Provides similar cybersecurity system use and threat information sharing authority to self-protected entities (an entity that provides goods or services for cybersecurity purposes to itself).
Requires the head of a federal agency receiving cyber threat information to provide such information to the National Cybersecurity and Communications Integration Center of the Department of Homeland Security (DHS), and allows such agency head to request the Center to provide such information to another federal agency. Sets forth requirements with respect to the use and protection of shared information, including prohibiting the use of such information to gain a competitive advantage and, if shared with the federal government, exempts such information from public disclosure. Prohibits a civil or criminal cause of action against a protected entity, a self-protected entity, or a cybersecurity provider acting in good faith under the above circumstances.
Allows the federal government to use shared cyber threat information: (1) for cybersecurity purposes to ensure the integrity, confidentiality, availability, or safeguarding of a system or network; (2) for the investigation of cybersecurity crimes; (3) for the protection of individuals from the danger of death or serious bodily harm and the prosecution of crimes involving such dangers (including the protection of minors from child pornography, sexual exploitation, kidnapping, and trafficking); or (4) to protect U.S. national security. Prohibits the federal government from affirmatively searching such information for any other purpose.
Provides for the protection of sensitive personal documents such as library records, firearms sales records, educational records, tax returns, and medical records. Requires a federal agency receiving information that is not cyber threat information to so notify the entity or provider of such information. Prohibits federal agencies from retaining shared information for any unauthorized use. Allows the federal government to undertake efforts to limit the impact of the sharing of such information on privacy and civil liberties. Outlines federal government liability for violations of restrictions on the disclosure, use, and protection of voluntarily shared information.
Directs the Inspector General of the Intelligence Community to submit annually to the congressional intelligence committees a review of the use of such information shared with the federal government, as well as recommendations for improvements and modifications to address privacy and civil liberties concerns.
Preempts any state statute that restricts or otherwise regulates an activity authorized by the Act.
States that nothing in this Act shall be construed to: (1) provide additional authority to, or modify existing authority of, any element of the intelligence community to control or direct the cybersecurity efforts of a private-sector entity or a component of the federal government or a state, local, or tribal government; (2) limit or affect existing information sharing relationships of the federal government; or (3) provide additional authority to, or modify existing authority of, any entity to use a cybersecurity system owned or controlled by the federal government on a private-sector system or network to protect the latter system or network.
[Congressional Bills 112th Congress]
[From the U.S. Government Publishing Office]
[H.R. 3523 Introduced in House (IH)]
112th CONGRESS
1st Session
H. R. 3523
To provide for the sharing of certain cyber threat intelligence and
cyber threat information between the intelligence community and
cybersecurity entities, and for other purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
November 30, 2011
Mr. Rogers of Michigan (for himself, Mr. Ruppersberger, Mr. King of New
York, Mr. Upton, Mrs. Myrick, Mr. Langevin, Mr. Conaway, Mr. Miller of
Florida, Mr. Boren, Mr. LoBiondo, Mr. Chandler, Mr. Nunes, Mr.
Gutierrez, Mr. Westmoreland, Mrs. Bachmann, Mr. Rooney, Mr. Heck, Mr.
Dicks, Mr. McCaul, Mr. Walden, Mr. Calvert, Mr. Shimkus, Mr. Terry, Mr.
Burgess, Mr. Gingrey of Georgia, Mr. Thompson of California, Mr.
Kinzinger of Illinois, Mr. Amodei, and Mr. Pompeo) introduced the
following bill; which was referred to the Select Committee on
Intelligence (Permanent Select)
_______________________________________________________________________
A BILL
To provide for the sharing of certain cyber threat intelligence and
cyber threat information between the intelligence community and
cybersecurity entities, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Cyber Intelligence Sharing and
Protection Act of 2011''.
SEC. 2. CYBER THREAT INTELLIGENCE AND INFORMATION SHARING.
(a) In General.--Title XI of the National Security Act of 1947 (50
U.S.C. 442 et seq.) is amended by adding at the end the following new
section:
``cyber threat intelligence and information sharing
``Sec. 1104. (a) Intelligence Community Sharing of Cyber Threat
Intelligence With Private Sector.--
``(1) In general.--The Director of National Intelligence
shall establish procedures to allow elements of the
intelligence community to share cyber threat intelligence with
private-sector entities and to encourage the sharing of such
intelligence.
``(2) Sharing and use of classified intelligence.--The
procedures established under paragraph (1) shall provide that
classified cyber threat intelligence may only be--
``(A) shared by an element of the intelligence
community with--
``(i) certified entities; or
``(ii) a person with an appropriate
security clearance to receive such cyber threat
intelligence;
``(B) shared consistent with the need to protect
the national security of the United States; and
``(C) used by a certified entity in a manner which
protects such cyber threat intelligence from
unauthorized disclosure.
``(3) Security clearance approvals.--The Director of
National Intelligence shall issue guidelines providing that the
head of an element of the intelligence community may, as the
head of such element considers necessary to carry out this
subsection--
``(A) grant a security clearance on a temporary or
permanent basis to an employee or officer of a
certified entity;
``(B) grant a security clearance on a temporary or
permanent basis to a certified entity and approval to
use appropriate facilities; and
``(C) expedite the security clearance process for a
person or entity as the head of such element considers
necessary, consistent with the need to protect the
national security of the United States.
``(4) No right or benefit.--The provision of information to
a private-sector entity under this subsection shall not create
a right or benefit to similar information by such entity or any
other private-sector entity.
``(b) Private Sector Use of Cybersecurity Systems and Sharing of
Cyber Threat Information.--
``(1) In general.--
``(A) Cybersecurity providers.--Notwithstanding any
other provision of law, a cybersecurity provider, with
the express consent of a protected entity for which
such cybersecurity provider is providing goods or
services for cybersecurity purposes, may, for
cybersecurity purposes--
``(i) use cybersecurity systems to identify
and obtain cyber threat information to protect
the rights and property of such protected
entity; and
``(ii) share such cyber threat information
with any other entity designated by such
protected entity, including, if specifically
designated, the Federal Government.
``(B) Self-protected entities.--Notwithstanding any
other provision of law, a self-protected entity may,
for cybersecurity purposes--
``(i) use cybersecurity systems to identify
and obtain cyber threat information to protect
the rights and property of such self-protected
entity; and
``(ii) share such cyber threat information
with any other entity, including the Federal
Government.
``(2) Use and protection of information.--Cyber threat
information shared in accordance with paragraph (1)--
``(A) shall only be shared in accordance with any
restrictions placed on the sharing of such information
by the protected entity or self-protected entity
authorizing such sharing, including, if requested,
appropriate anonymization or minimization of such
information;
``(B) may not be used by an entity to gain an
unfair competitive advantage to the detriment of the
protected entity or the self-protected entity
authorizing the sharing of information; and
``(C) if shared with the Federal Government--
``(i) shall be exempt from disclosure under
section 552 of title 5, United States Code;
``(ii) shall be considered proprietary
information and shall not be disclosed to an
entity outside of the Federal Government except
as authorized by the entity sharing such
information; and
``(iii) shall not be used by the Federal
Government for regulatory purposes.
``(3) Exemption from liability.--No civil or criminal cause
of action shall lie or be maintained in Federal or State court
against a protected entity, self-protected entity,
cybersecurity provider, or an officer, employee, or agent of a
protected entity, self-protected entity, or cybersecurity
provider, acting in good faith--
``(A) for using cybersecurity systems or sharing
information in accordance with this section; or
``(B) for not acting on information obtained or
shared in accordance with this section.
``(4) Relationship to other laws requiring the disclosure
of information.--The submission of information under this
subsection to the Federal Government shall not satisfy or
affect any requirement under any other provision of law for a
person or entity to provide information to the Federal
Government.
``(c) Report on Information Sharing.--The Privacy and Civil
Liberties Oversight Board established under section 1061 of the
Intelligence Reform and Terrorism Prevention Act of 2004 (5 U.S.C. 601
note) shall annually submit to Congress a report in unclassified form
containing--
``(1) a review of the sharing and use of information by the
Federal Government under this section and the procedures and
guidelines established or issued by the Director of National
Intelligence under subsection (a); and
``(2) any recommendations of the Board for improvements or
modifications to such authorities to address privacy and civil
liberties concerns.
``(d) Federal Preemption.--This section supersedes any statute of a
State or political subdivision of a State that restricts or otherwise
expressly regulates an activity authorized under subsection (b).
``(e) Savings Clause.--Nothing in this section shall be construed
to limit any other authority to use a cybersecurity system or to
identify, obtain, or share cyber threat intelligence or cyber threat
information.
``(f) Definitions.--In this section:
``(1) Certified entity.--The term `certified entity' means
a protected entity, self-protected entity, or cybersecurity
provider that--
``(A) possesses or is eligible to obtain a security
clearance, as determined by the Director of National
Intelligence; and
``(B) is able to demonstrate to the Director of
National Intelligence that such provider or such entity
can appropriately protect classified cyber threat
intelligence.
``(2) Cyber threat intelligence.--The term `cyber threat
intelligence' means information in the possession of an element
of the intelligence community directly pertaining to a
vulnerability of, or threat to, a system or network of a
government or private entity, including information pertaining
to the protection of a system or network from--
``(A) efforts to degrade, disrupt, or destroy such
system or network; or
``(B) theft or misappropriation of private or
government information, intellectual property, or
personally identifiable information.
``(3) Cybersecurity provider.--The term `cybersecurity
provider' means a non-governmental entity that provides goods
or services intended to be used for cybersecurity purposes.
``(4) Cybersecurity purpose.--The term `cybersecurity
purpose' means the purpose of ensuring the integrity,
confidentiality, or availability of, or safeguarding, a system
or network, including protecting a system or network from--
``(A) efforts to degrade, disrupt, or destroy such
system or network; or
``(B) theft or misappropriation of private or
government information, intellectual property, or
personally identifiable information.
``(5) Cybersecurity system.--The term `cybersecurity
system' means a system designed or employed to ensure the
integrity, confidentiality, or availability of, or safeguard, a
system or network, including protecting a system or network
from--
``(A) efforts to degrade, disrupt, or destroy such
system or network; or
``(B) theft or misappropriation of private or
government information, intellectual property, or
personally identifiable information.
``(6) Cyber threat information.--The term `cyber threat
information' means information directly pertaining to a
vulnerability of, or threat to a system or network of a
government or private entity, including information pertaining
to the protection of a system or network from--
``(A) efforts to degrade, disrupt, or destroy such
system or network; or
``(B) theft or misappropriation of private or
government information, intellectual property, or
personally identifiable information.
``(7) Protected entity.--The term `protected entity' means
an entity, other than an individual, that contracts with a
cybersecurity provider for goods or services to be used for
cybersecurity purposes.
``(8) Self-protected entity.--The term `self-protected
entity' means an entity, other than an individual, that
provides goods or services for cybersecurity purposes to
itself.''.
(b) Procedures and Guidelines.--The Director of National
Intelligence shall--
(1) not later than 60 days after the date of the enactment
of this Act, establish procedures under paragraph (1) of
section 1104(a) of the National Security Act of 1947, as added
by subsection (a) of this section, and issue guidelines under
paragraph (3) of such section 1104(a); and
(2) following the establishment of such procedures and the
issuance of such guidelines, expeditiously distribute such
procedures and such guidelines to appropriate Federal
Government and private-sector entities.
(c) Initial Report.--The first report required to be submitted
under subsection (c) of section 1104 of the National Security Act of
1947, as added by subsection (a) of this section, shall be submitted
not later than one year after the date of the enactment of this Act.
(d) Table of Contents Amendment.--The table of contents in the
first section of such Act is amended by adding at the end the following
new item:
``Sec. 1104. Cyber threat intelligence and information sharing.''.
<all>
Considered as unfinished business. (consideration: CR H2175-2186)
The House resolved into Committee of the Whole House on the state of the Union for further consideration.
DEBATE - Pursuant to the provisions of H. Res. 631, the Committee of the Whole proceeded with 10 minutes of debate on the Turner (OH) amendment No. 14.
DEBATE - Pursuant to the provisions of H. Res. 631, the Committee of the Whole proceeded with 10 minutes of debate on the Mulvaney amendment No. 15.
POSTPONED PROCEEDINGS - At the conclusion of debate on the Mulvaney amendment No. 15, the Chair put the question on adoption of the amendment and by voice vote announced that the ayes had prevailed. Mr. Mulvaney demanded a recorded vote and the Chair postponed further proceedings on the question of adoption of the amendment until later in the legislative day.
DEBATE - Pursuant to the provisions of H. Res. 631, the Committee of the Whole proceeded with 10 minutes of debate on the Jackson Lee (TX) amendment No. 5.
DEBATE - Pursuant to the provisions of H. Res. 631, the Committee of the Whole proceeded with 10 minutes of debate on the Richardson amendment No. 10.
The House rose from the Committee of the Whole House on the state of the Union to report H.R. 3523.
The previous question was ordered pursuant to the rule. (consideration: CR H2183)
Llama 3.2 · runs locally in your browser
Ask anything about this bill. The AI reads the full text to answer.
Enter to send · Shift+Enter for new line
The House adopted the amendment in the nature of a substitute as agreed to by the Committee of the Whole House on the state of the Union. (text of amendment in the nature of a substitute: CR H2166-2167)
Mr. Perlmutter moved to recommit with instructions to Intelligence (Permanent). (consideration: CR H2184-2186; text: CR H2184)
DEBATE - The House proceeded with 10 minutes of debate on the Perlmutter motion to recommit with instructions. The instructions contained in the motion seek to require the bill to be reported back to the House with an amendment to protect the privacy of Internet passwords by prohibiting employers and the Federal Government from requiring the disclosure of confidential passwords by an employee or job applicant. It would also protect freedom of expression on the Internet by prohibiting the Federal Government from establishing a national firewall similar to the "Great Internet Firewall of China."
The previous question on the motion to recommit with instructions was ordered without objection. (consideration: CR H2185)
On motion to recommit with instructions Failed by the Yeas and Nays: 183 - 233 (Roll no. 191).
Roll Call #191 (House)Passed/agreed to in House: On passage Passed by recorded vote: 248 - 168 (Roll no. 192).
Roll Call #192 (House)Motion to reconsider laid on the table Agreed to without objection.
On passage Passed by recorded vote: 248 - 168 (Roll no. 192).
Roll Call #192 (House)The Clerk was authorized to correct section numbers, punctuation, and cross references, and to make other necessary technical and conforming corrections in the engrossment of H.R. 3523. (consideration: CR H2186)
UNANIMOUS CONSENT - Mr. Mike Rogers (MI) asked unanimous consent that in the engrossment of H.R. 3523, the Clerk be authorized to make the change placed at the desk as follows: Insert "deny access to or" before "degrade" in each place it appears. Agreed to without objection.
Received in the Senate and Read twice and referred to the Select Committee on Intelligence.