6 U.S.C. § 1507 — Construction and preemption

(a) Otherwise lawful disclosures. Nothing in this subchapter limits or prohibits an otherwise lawful disclosure of communications, records, or other information by a non-Federal entity^* to another non-Federal entity or to the Federal Government under this subchapter. This includes reporting known or suspected criminal activity. Nothing limits or prohibits an otherwise lawful Federal use of such disclosures, even if they duplicate or repeat disclosures made under this subchapter.

(b) Whistleblower protections. Nothing in this subchapter prohibits or limits disclosure of information protected by section 2302(b)(8) of title 5, about illegality, waste, fraud, abuse, or threats to public health or safety; section 7211 of title 5, about disclosures to Congress; section 1034 of title 10, about disclosures to Congress by members of the military; section 3234 of title 50, about disclosures by intelligence-community employees; or a similar provision of Federal or State^* law.

(c) Protection of sources and methods. Nothing in this subchapter: (1) gives immunity from, or otherwise affects, an action by the Federal Government or one of its agencies or departments to enforce a law, executive order, or procedure governing the proper handling, disclosure, or use of classified information; (2) affects authorized law-enforcement or intelligence activities; or (3) changes a Federal department's or agency's authority to protect classified information, sources and methods, or the national security of the United States.

(d) Relationship to other laws. Nothing in this subchapter affects any requirement under another law that requires a non-Federal entity to provide information to the Federal Government.

(e) Prohibited conduct. Nothing in this subchapter permits price-fixing, dividing a market among competitors, monopolizing or trying to monopolize a market, boycotting, or exchanging price or cost information, customer lists, or information about future competitive plans.

(f) Information-sharing relationships. Nothing in this subchapter: (1) limits or changes an existing information-sharing relationship; (2) prohibits a new information-sharing relationship; (3) requires a new information-sharing relationship between a non-Federal entity and a Federal entity or another non-Federal entity; or (4) requires use of the capability and process developed within the Department^* of Homeland Security under section 1504(c) of this title.

(g) Preservation of contractual obligations and rights. Nothing in this subchapter: (1) amends, repeals, or replaces a current or future contract, terms-of-service agreement, or other contractual relationship between non-Federal entities or between a non-Federal entity and a Federal entity; or (2) cancels a trade-secret or intellectual-property right of a non-Federal or Federal entity.

(h) Anti-tasking restriction. Nothing in this subchapter permits a Federal entity to: (1) require a non-Federal entity to provide information to a Federal entity or another non-Federal entity; (2) make a non-Federal entity's sharing of cyber threat indicators depend on that entity providing cyber threat indicators to a Federal entity or another non-Federal entity; or (3) make awarding a Federal grant, contract, or purchase depend on providing a cyber threat indicator^* to a Federal entity or another non-Federal entity.

(i) No liability for non-participation. Nothing in this subchapter makes an entity liable for choosing not to take part in the voluntary activities authorized by this subchapter.

(j) Use and retention of information. Nothing in this subchapter authorizes, or changes existing authority of, a Federal department or agency^* to retain or use information shared under this subchapter for a use other than one permitted by this subchapter.

(k) Federal preemption. (1) In general. This subchapter overrides a State statute or other State or local-law provision that restricts or expressly regulates an activity authorized under this subchapter. (2) State law enforcement. Nothing in this subchapter overrides a State statute or other State or local-law provision about using authorized law-enforcement practices and procedures.

(l) Regulatory authority. Nothing in this subchapter: (1) authorizes regulations that this subchapter does not specifically authorize; (2) creates or limits regulatory authority that this subchapter does not specifically create or limit; or (3) authorizes regulatory actions that would duplicate or conflict with regulatory requirements, mandatory standards, or related processes under another Federal law.

(m) Authority of Secretary^* of Defense to respond to malicious cyber activity carried out by foreign powers. Nothing in this subchapter limits the Secretary of Defense's authority under section 394 of title 10.

(n) Criminal prosecution. Nothing in this subchapter prevents disclosure of a cyber threat indicator or defensive measure^* shared under this subchapter in a criminal prosecution when applicable Federal, State, tribal, or local law requires disclosure in that case.