6 U.S.C. § 1504 — Sharing of cyber threat indicators and defensive measures with the Federal Government

(a) Policies and procedures. (1) Within 60 days after December 18, 2015, the Attorney General and Secretary^* of Homeland Security, consulting appropriate Federal entities^*, had to jointly develop and submit interim policies and procedures for the Federal Government’s receipt of cyber threat indicators and defensive measures. (2) Within 180 days, they had to jointly issue and publicly release final policies and procedures. (3) Consistent with subsection (b), the policies must ensure that real-time indicators shared under section 1503(c) are automatically shared with all appropriate Federal entities; are delayed, modified, or otherwise acted on only because of real-time controls that all entity heads unanimously agreed to, that operate before any entity retains or uses the information, and that apply uniformly; and may be given to other Federal entities. Indicators shared in another way under section 1503 must be shared with all appropriate Federal entities as quickly as operationally practicable, without unnecessary delay or interference, and may be given to other Federal entities. The policies must also provide audit capabilities and appropriate sanctions for Federal officers, employees, or agents who knowingly and willfully act without authorization under this subchapter. (4)(A) Within 60 days, the Attorney General and Secretary had to jointly develop and publicly release guidance to help entities share indicators with Federal entities. (B) The guidance must identify information types likely to qualify as indicators without including information unrelated to a cybersecurity threat^* or personal information that identifies a specific person; identify information protected by privacy laws that is unlikely to relate directly to a cybersecurity threat; and cover other matters the Attorney General and Secretary consider appropriate. (b) Privacy and civil liberties. (1) Within 60 days, the Attorney General and Secretary, consulting appropriate Federal entities and officers designated under section 2000ee–1 of title 42, had to develop, submit to Congress, and make public interim guidelines governing Federal entities’ receipt, retention, use, and dissemination of indicators obtained under this subchapter. (2)(A) Within 180 days, they had to issue and make public final guidelines, coordinating with appropriate entities and consulting the designated officers and relevant private entities with industry expertise. (B) They must review the guidelines periodically, at least every two years, with the same coordination and consultation. (3) The guidelines must, while protecting information systems from and reducing cybersecurity threats: (A) limit effects on privacy and civil liberties; (B) limit handling of indicators containing personal information, including timely destruction of information known not to relate directly to authorized uses and limits on retention periods; (C) protect such indicators from unauthorized access or acquisition and provide sanctions for Federal personnel who violate the guidelines; (D) govern Federal retention, use, and dissemination consistently with this subchapter, other law, and the fair-information-practice principles in appendix A of the President’s April 2011 National Strategy for Trusted Identities in Cyberspace, including whether the Government may use the indicators; (E) provide notice to entities and Federal entities when received information is known or determined not to be an indicator; (F) protect confidentiality as much as practicable and tell recipients that the indicators may be used only for authorized purposes; and (G) include steps needed to protect classified and other sensitive national-security information. (c) DHS capability and process. (1) Within 90 days, the Secretary of Homeland Security, coordinating with appropriate Federal entities, had to develop and implement a DHS capability and process that: (A) accepts real-time indicators and defensive measures from any non-Federal entity^*; (B) after the paragraph (2) certification, is the process for receiving indicators and measures shared by email or other media, an Internet form, or an automated real-time system, except communications about a previously shared indicator to describe the threat or develop a measure, and communications by a regulated entity with its Federal regulator about a cybersecurity threat; (C) automatically gives real-time submissions to all appropriate Federal entities; (D) follows this section’s policies, procedures, and guidelines; and (E) does not limit lawful disclosures, including reporting suspected crime to another non-Federal or Federal entity, participation in a Federal investigation voluntarily or when legally compelled, and providing information under a statutory or authorized contract requirement. (2)(A) Within 90 days, the Secretary had to certify to Congress, after consultation, whether the capability fully and effectively operates as the Federal Government’s receipt process and follows the interim policies, procedures, and guidelines. (B)(i) After that certification, the President may designate an appropriate Federal entity other than the Department^* of Defense, including NSA, to create an additional process, but at least 30 days beforehand must certify and explain to Congress that the designation is necessary for full, effective, and secure operation; the entity will follow this subchapter, including subsection (a)(3)(A); and the designation fits the entity’s mission and improves Federal receipt, sharing, and use. (ii) Rules applying to the paragraph (1) process also apply to the additional process. (3) The Secretary must provide public notice of and access to the DHS process so any non-Federal entity can share information and all appropriate Federal entities receive it in real time consistently with subsection (a). (4) The process must ensure other Federal entities receive shared information promptly. (d) Information provided to the Federal Government. (1) Providing indicators or measures does not waive any legal privilege or protection, including trade-secret protection. (2) If designated by the originating entity, or a third party authorized in writing by it, information is treated as that entity’s commercial, financial, and proprietary information, consistent with section 1503(c)(2) and other law. (3) Shared information is treated as voluntarily provided and exempt from disclosure under section 552 of title 5 and state^*, tribal, and local disclosure laws, and must be withheld from the public under section 552(b)(3)(B) and those laws. (4) Providing it is not subject to Federal agency^* rules or judicial doctrines about ex parte communications with a decision-maker. (5)(A) Consistent with other Federal law, Federal agencies, departments, components, officers, employees, and agents may disclose, retain, and use it only for: (i) cybersecurity; (ii) identifying a cybersecurity threat, including its source, or a security weakness; (iii) responding to, preventing, or reducing a specific threat of death, serious bodily harm, or serious economic harm, including terrorism or use of a weapon of mass destruction; (iv) responding to, investigating, prosecuting, preventing, or reducing a serious threat to a minor, including sexual exploitation and threats to physical safety; or (v) preventing, investigating, disrupting, or prosecuting an offense arising from a threat in clause (iii), or an offense under title 18 sections 1028 through 1030, chapter 37, or chapter 90. (B) No Federal agency or department may handle it for a use not allowed by (A). (C) The Government must handle it under subsections (a) and (b), protect it from unauthorized use or disclosure when it contains personal information or information identifying a person, and protect its confidentiality. (D)(i) Except as provided in (ii), no Federal, State, tribal, or local government^* may use it to regulate or enforce against a non-Federal entity’s lawful activities, or activities required by mandatory standards, including monitoring, operating defensive measures, or sharing indicators. (ii)(I) It may, consistently with Federal or State authority specifically addressing prevention or reduction of cybersecurity threats to information systems, inform regulations about those systems. (II) Clause (i) does not apply to procedures developed and implemented under this subchapter.