10 U.S.C. § 395 — Notification requirements for sensitive military cyber operations

(a) In General: Except as (d) allows, the Secretary of Defense must promptly give the congressional defense committees written notice of any "sensitive military cyber operation" conducted under this title, no later than 48 hours after the operation happens. (b) Procedures: The Secretary must create and submit to the congressional defense committees procedures for meeting the requirement in (a), consistent with national security and protecting how operations work. If the Secretary changes these procedures, the committees must be notified in writing at least 14 days before the change takes effect. The congressional defense committees must make sure their own procedures for protecting classified national security information are strong enough to protect the information submitted to them under this section. If a sensitive military cyber operation covered by this section is disclosed without authorization, the Secretary must make sure, as much as practically possible, that the committees are notified immediately. That notice can be verbal or written, but if it is verbal, a written notice signed by the Secretary or the Secretary's designee must follow within 48 hours. (c) Sensitive Military Cyber Operation Defined: A "sensitive military cyber operation" is an offensive or defensive cyber operation that is carried out by U.S. armed forces; is meant to achieve a cyber effect against a foreign terrorist organization, or against a country — including its armed forces and that country's proxy forces elsewhere — where either U.S. armed forces are not involved in "hostilities" with that country, as defined in the War Powers Resolution, or the U.S. has not publicly acknowledged being involved in hostilities with that country; and either is determined to have a medium or high collateral-effects estimate, a medium or high risk of intelligence gain or loss, a medium or high chance of political retaliation based on a political-military assessment in the operation's plan, a medium or high chance of unintended detection, or medium or high collateral effects — or is an operation the Secretary decides should count as sensitive for other reasons. (d) Exceptions: The notification requirement in (a) does not apply to a training exercise done with the consent of every nation where the exercise's intended effects will happen, or to a "covert action," as defined in section 503 of the National Security Act of 1947. (e) Rule of Construction: Nothing in this section should be read to create new authority, or to change the War Powers Resolution, the 2001 Authorization for Use of Military Force, or any requirement under the National Security Act of 1947.