10 U.S.C. § 394 — Authorities concerning military cyber operations

(a) In General: The Secretary of Defense must develop, prepare, and coordinate military cyber activities and operations in cyberspace; get all armed forces ready for them; and, when properly authorized, actually carry them out — including clandestine (secret) ones. The goal is to defend the United States and its allies, including responding to malicious cyber activity carried out against the U.S. or a U.S. person by a foreign power. (b) Affirmation of Authority: Congress confirms that these authorized activities include military cyberspace operations that fall short of "hostilities" (as that word is used in the War Powers Resolution), or that happen in places where hostilities are not occurring. This includes activities for preparing the environment, information operations, protecting forces, deterring hostilities, or counterterrorism operations involving the armed forces. (c) Clandestine Activities or Operations: A clandestine military cyber activity or operation counts as a "traditional military activity" for purposes of section 503(e)(2) of the National Security Act of 1947. (d) Congressional Oversight: The Secretary must brief the congressional defense committees about any military cyberspace activities or operations — including clandestine ones — that happened in the previous quarter, as part of the regular quarterly briefing already required by section 484 of this title. (e) Rule of Construction: Nothing in this section should be read to limit the Secretary's authority to conduct military cyberspace activities, to authorize any specific activity, or to change the War Powers Resolution, the 2001 Authorization for Use of Military Force, or the reporting of sensitive military cyber activities required by section 395 of this title. (f) Definitions: "Clandestine military activity or operation in cyberspace" means a military activity or operation in cyberspace (or steps taken to prepare for one) that the President or Secretary authorized, and that is done, held, or carried out secretly, meant not to be publicly apparent or acknowledged, and is carried out either as part of a military operation plan the President or Secretary approved in anticipation of hostilities or as they directed; to deter, safeguard, or defend against attacks or malicious cyber activity against the U.S. or Department of Defense information, networks, systems, installations, facilities, or other assets; or to support "information related capabilities." "Foreign power" has the meaning given in section 101 of the Foreign Intelligence Surveillance Act of 1978. "United States person" has the meaning given in that same section.