Summary:
TITLE I--PROTECTING CYBER NETWORKS ACT

Protecting Cyber Networks Act

(Sec. 102) Amends the National Security Act of 1947 to require the Director of National Intelligence (DNI) to develop and promulgate procedures to promote: (1) the timely sharing of classified and declassified cyber threat indicators in possession of the federal government with private entities, non-federal government agencies, or state, tribal, or local governments; and (2) the sharing of imminent or ongoing cybersecurity threats with such entities to prevent or mitigate adverse impacts.

Requires the procedures to provide for: (1) notification to entities when the federal government has shared indicators in error or in contravention of law; and (2) the federal government, prior to sharing indicators, to remove personal information of, or information identifying, a specific person not directly related to a cybersecurity threat.

Directs the DNI to submit such procedures to Congress within 90 days after enactment of this title.

 (Sec. 103) Permits private entities to monitor or operate defensive measures to prevent or mitigate cybersecurity threats or security vulnerabilities, or to identify the source of a threat, on: (1) their own information systems; and (2) with written authorization, the information systems of other private or government entities. Authorizes entities to conduct such activities on information that is stored on, processed by, or transiting such monitored systems.

Prohibits defensive measures from being used to destroy, render unusable or inaccessible, or substantially harm an information system that is not owned by: (1) the operator of the defensive measure, or (2) an entity that authorizes the operation of defensive measures on its systems.

Allows non-federal entities to share and receive indicators or defensive measures with other non-federal entities or specifically designated federal entities, but does not authorize non-federal entities to share directly with components of the Department of Defense (DOD), including the National Security Agency (NSA). Allows otherwise lawful sharing by non-federal entities of indicators or defensive measures with DOD or the NSA. Requires recipients to comply with lawful restrictions that sharing entities place on the sharing or use of shared indicators or defensive measures.

Requires non-federal entities monitoring, operating, or sharing indicators or defensive measures: (1) to implement security controls to protect against unauthorized access or acquisitions; and (2) prior to sharing an indicator, to take reasonable efforts to remove information that the non-federal entity reasonably believes to be personal information of, or information identifying, a specific person not directly related to a cybersecurity threat.

Permits state, tribal, or local agencies to use shared indicators or defensive measures:

 to protect (including through the use of a defensive measure) an information system or information that is stored on, processed by, or transiting an information system from a cybersecurity threat or security vulnerability or to identify the source of a cybersecurity threat; to respond to, prosecute, prevent, or mitigate a threat of death or serious bodily harm or an offense arising out of such a threat; or to respond to, prevent, or mitigate a serious threat to a minor, including sexual exploitation and threats to physical safety. Requires the Small Business Administration (SBA) to provide assistance to small businesses and financial institutions to monitor information systems, operate defensive measures, and share and receive indicators and defensive measures. Directs the SBA to submit to the President a report regarding the degree to which small businesses and financial institutions are able to engage in such sharing. Requires the federal government to conduct outreach to encourage such businesses and institutions to engage in those activities.

(Sec. 104) Directs the President to report on procedures for the receipt of cyber threat indicators and defensive measures by the federal government. Requires the procedures to ensure that: (1) cyber threat indicators shared by a non-federal entity with the Department of Commerce, the Department of Energy, the Department of Homeland Security (DHS), the Department of Justice (DOJ), the Department of the Treasury, and the DNI (but not DOD, including the NSA) are shared in real time with all appropriate federal entities; (2) such indicators are provided to other relevant federal entities; (3) there is an audit capability; and (4) there are appropriate sanctions for federal officers, employees, or agents who use shared indicators or defensive measures in an unauthorized manner.

Requires DOJ to develop and periodically review privacy and civil liberties guidelines to govern the receipt, retention, use, and dissemination of cyber threat indicators by federal entities, including guidelines to ensure that personal information of, or information identifying, specific persons is properly removed from information received, retained, used, or disseminated by a federal entity.

Establishes within the Office of the Director of National Intelligence a Cyber Threat Intelligence Integration Center (CTIIC) to serve as the primary organization within the federal government for analyzing and integrating all intelligence possessed or acquired by the United States pertaining to cyber threats. Requires the CTIIC to: (1) ensure that appropriate agencies receive all-source intelligence support to execute cyber threat intelligence activities and perform independent, alternative analyses; (2) disseminate threat analysis to the President, federal agencies, and Congress; and (3) coordinate federal cyber threat intelligence activities and conduct strategic planning.

Requires the head of the CTIIC to be appointed by the DNI.

Authorizes indicators or defensive measures to be disclosed to, retained by, and used by, consistent with otherwise applicable federal law, any agency or agent of the federal government solely for:

 protecting an information system or information that is stored on, processed by, or transiting an information system from a cybersecurity threat or security vulnerability or identifying the source of a cybersecurity threat; responding to, investigating, prosecuting, or otherwise preventing or mitigating a threat of death or serious bodily harm or an offense arising out of such a threat; responding to, investigating, prosecuting, or otherwise preventing or mitigating a serious threat to a minor, including sexual exploitation and threats to physical safety; or preventing, investigating, disrupting, or prosecuting specified criminal offenses relating to fraud and identity theft, serious violent felonies, espionage and censorship, or trade secrets. (Sec. 105) Allows a person to bring a private cause of action against the federal government if an agency intentionally or willfully violates DOJ's privacy and civil liberties guidelines.

(Sec. 106) Provides liability protections to: (1) private entities that monitor information systems; or (2) non-federal entities that share, receive, or fail, in good faith, to act upon shared indicators or defensive measures.

Prohibits such liability protections from being construed to apply to willful misconduct.

(Sec. 107) Requires reports to Congress, at least biennially, by: (1) the DNI regarding the implementation of the federal government's information sharing procedures, including assessments of any misuse of information or disciplinary actions taken; and (2) inspectors general of specified agencies regarding the receipt, use, and dissemination of indicators and defensive measures that have been shared with federal entities.

Directs the Privacy and Civil Liberties Oversight Board, every two years, to report to Congress and the President regarding the sufficiency of procedures to address privacy and civil liberties concerns.

(Sec. 108) Directs the DNI, in a report to Congress regarding cyber threats, attacks, theft, and data breaches, to: (1) assess current U.S. intelligence sharing and cooperation relationships with other countries regarding cybersecurity threats to U.S. national security interests, the economy, and intellectual property; (2) list countries and non-state actors that are primary threats; (3) describe U.S. response and prevention capabilities; and (4) assess additional technologies that would enhance U.S. capabilities, including private sector technologies that could be rapidly fielded to assist the intelligence community.

 Requires unclassified portions of reports under this title to be made publicly available.

 (Sec. 109) Prohibits this title from being construed to: (1) authorize the federal government to conduct surveillance of a person or allow the intelligence community to target a person for surveillance; (2) limit lawful disclosures of communications or records, including reporting of known or suspected criminal activity, by a non-federal entity to another non-federal entity or the federal government; or (3) permit the federal government to require a non-federal entity to provide information to the federal government.

(Sec. 111) Requires the Government Accountability Office (GAO) to report on federal actions to remove personal information from shared cyber threat indicators.

(Sec. 112) Terminates the provisions of this title seven years after its enactment.

TITLE II--NATIONAL CYBERSECURITY PROTECTION ADVANCEMENT ACT

National Cybersecurity Protection Advancement Act of 2015 (Sec. 202) Amends the Homeland Security Act of 2002 to allow DHS's national cybersecurity and communications integration center (NCCIC) to include tribal governments, information sharing and analysis centers, and private entities among its non-federal representatives. Expands the composition of the NCCIC to include:

 a collaborator with state and local governments on cybersecurity risks and incidents; a U.S. Computer Emergency Readiness Team that coordinates and shares information in a timely manner and provides technical assistance, upon request, to information system owners and operators; the Industrial Control System Cyber Emergency Response Team that coordinates with owners and operators of industrial control systems, provides requested training, and remains current on industry adoption of new technologies; a National Coordinating Center for Communications that coordinates the protection, response, and recovery of emergency communications; and a coordinator of small and medium-sized businesses. (Sec. 203) Requires the NCCIC to be the lead federal civilian interface for multi-directional and cross-sector sharing of information related to cyber threat indicators, defensive measures, and cybersecurity risks for federal and non-federal entities. Expands the NCCIC's functions to include:

 global cybersecurity with international partners; information sharing across critical infrastructure sectors, with state and major urban area fusion centers and with small and medium-sized businesses; notification to Congress regarding any significant violations of information retention or disclosure policies; notification to non-federal entities of indicators or defensive measures shared in error or in contravention of specified requirements; and participation in exercises run by DHS's National Exercise Program. Excludes from the definition of "cybersecurity risk" violations of consumer terms of service or licensing agreements.

Requires the NCCIC to designate an agency contact for non-federal entities.

Directs the NCCIC to: (1) safeguard cybersecurity information against unauthorized disclosure, and (2) work with the Chief Privacy Officer to follow appropriate privacy procedures.

Requires the Under Secretary for Cybersecurity and Infrastructure Protection (the Under Secretary) to develop capabilities that make use of existing industry standards to advance implementation of automated mechanisms for the timely sharing of indicators and defensive measures to and from the NCCIC and with federal agencies designated as sector specific agencies for critical infrastructure sectors.

Directs the Under Secretary, every six months, to provide Congress with progress reports regarding the development of such capabilities.

Authorizes the NCCIC to enter voluntary information sharing relationships with consenting non-federal entities.

Directs the Under Secretary to develop procedures for coordinating vulnerability disclosures consistent with international standards.

Allows non-federal entities, for cybersecurity purposes, to share with other non-federal entities or the NCCIC any indicators or defensive measures obtained from: (1) their own information systems; or (2) the information systems of other federal or non-federal entities, with written consent. Authorizes non-federal entities (excluding state, local, or tribal governments) to conduct network awareness to scan, identify, acquire, monitor, log, or analyze information, or to operate defensive measures, on the information systems of entities that provide consent.

Requires entities, prior to sharing, to take reasonable efforts to: (1) exclude information that can be used to identify specific persons and that is unrelated to cybersecurity risks or incidents, and (2) safeguard information that can be used to identify specific persons from unintended disclosure or unauthorized access or acquisition.

Directs the Under Secretary to establish and annually review privacy and civil liberties policies governing the receipt, retention, use, and disclosure of cybersecurity information shared with the NCCIC. Provides for such policies to apply only to DHS. Allows the Under Secretary to consult with the National Institute of Standards and Technology on such policies.

Requires the Chief Privacy Officer to:

 monitor implementation of such privacy and civil liberties policies; update privacy impact assessments on a regular basis to ensure that all relevant privacy protections are followed; work with the Under Secretary to carry out certain notifications to Congress and non-federal entities; submit an annual report to Congress regarding the effectiveness of DHS's privacy and civil liberties policies; and ensure appropriate sanctions for DHS officers, employees, or agents who intentionally or willfully conduct activities in an unauthorized manner. Directs the DHS Inspector General to periodically report to Congress with a review of the use of cybersecurity risk information shared with the NCCIC.

Requires the Chief Privacy Officer and the Chief Civil Rights and Civil Liberties Officer to biennially submit a report to Congress that: (1) assesses the privacy and civil liberties impact of DHS's retention, use, and disclosure policies; and (2) recommends methods to minimize or mitigate the impact of sharing indicators and defensive measures.

Prohibits federal entities from using shared indicators or defensive measures to engage in surveillance or other collection activities for the purpose of tracking an individual's personally identifiable information, except for purposes authorized under this section. Bars the federal government from using such information for regulatory purposes.

Provides liability protections to non-federal entities (excluding state, local, or tribal governments) acting in accordance with this section that: (1) conduct network awareness, or (2) share indicators or defensive measures or that fail, in good faith, to act based on such sharing.

Prohibits such liability protections from being construed to apply to willful misconduct.

Establishes a private cause of action that a person may bring against the federal government if a federal agency intentionally or willfully violates restrictions on the use and protection of voluntarily shared indicators or defensive measures.

Exempts from antitrust laws non-federal entities that, for cybersecurity purposes, share: (1) cyber threat indicators or defensive measures; or (2) assistance relating to the prevention, investigation, or mitigation of cybersecurity risks or incidents. Makes such exemption inapplicable to price-fixing, allocating a market between competitors, monopolizing or attempting to monopolize a market, or exchanges of price or cost information, customer lists, or information regarding future competitive planning.

Prohibits this section from being construed to permit the federal government to require a non-federal entity to provide information to a federal entity.

Requires the Secretary of Homeland Security to: (1) develop procedures for the NCCIC Director to report directly to the Secretary regarding significant cybersecurity risks and incidents, and (2) promote a national awareness effort to educate the general public on the importance of securing information systems.

Directs DHS to report to Congress on the range of efforts underway to bolster cybersecurity collaboration with relevant international partners.

(Sec. 204) Expands the purpose of information sharing and analysis organizations to include responsibilities for disseminating information about cybersecurity risks and incidents.

(Sec. 205) Redesignates DHS's National Protection and Programs Directorate as the Cybersecurity and Infrastructure Protection. Requires the President to appoint: (1) the Under Secretary, with the advice and consent of the Senate; and (2) the Deputy Under Secretaries for Cybersecurity and for Infrastructure Protection, without the advice and consent of the Senate. Requires the Under Secretary to report to Congress regarding the feasibility of becoming an operational component.

(Sec. 206) Requires the Secretary to regularly update, maintain, and exercise the Cyber Incident Annex to DHS's National Response Framework.

(Sec. 207) Requires the NCCIC to facilitate improvements to the security and resiliency of public safety communications.

Directs the Under Secretary to implement a cybersecurity awareness campaign to disseminate: (1) public service announcements targeted at state, local, and tribal governments, the private sector, academia, and stakeholders in specific audiences, including the elderly, students, small businesses, members of the Armed Forces, and veterans; and (2) vendor and technology-neutral voluntary best practices.

Requires DHS to establish a National Cybersecurity Preparedness Consortium to:

 train state and local first responders and officials to prepare for and respond to cyber attacks, develop a curriculum utilizing the DHS-sponsored Community Cyber Security Maturity Model, provide technical assistance, conduct cybersecurity training and simulation exercises, coordinate with the NCCIC to help states and communities develop information sharing programs, and coordinate with the National Domestic Preparedness Consortium to incorporate cybersecurity emergency responses into existing state and local emergency management functions. (Sec. 208) Directs the Under Secretary for Science and Technology to biennially provide to Congress an updated strategic plan to guide the overall direction of federal physical security and cybersecurity technology research and development efforts for protecting critical infrastructure. Requires the plan to:

 identify critical infrastructure security risks and any associated security technology gaps; prioritize technology needs based on gaps, risks, evolving threats, and technology advancements; include research, development, and acquisition roadmaps with clearly defined objectives, goals, and measures; identify laboratories, facilities, modeling, and simulation capabilities required to support new technologies; and identify programmatic initiatives for the rapid advancement and deployment of security technologies for critical infrastructure protection, including public-private partnerships, intragovernment collaboration, university centers of excellence, and national laboratory technology transfers. (Sec. 209) Requires DHS to report to Congress regarding the feasibility of DHS reducing cybersecurity risks in DHS data centers, including by increasing compartmentalization between systems and providing a mix of security controls between such compartments.

(Sec. 210) Directs the GAO to report on DHS's implementation of this title, including any findings regarding increases in sharing at the NCCIC and throughout the United States.

(Sec. 211) Requires the Under Secretary to produce a report on the feasibility of creating a risk-informed prioritization plan should multiple critical infrastructures experience cyber incidents simultaneously.

(Sec. 212) Directs the DHS Inspector General to review operations of the U.S. Computer Emergency Readiness Team and the Industrial Control Systems Cyber Emergency Response Team to assess the capacity to provide technical assistance to non-federal entities and to adequately respond to potential increases in requests for technical assistance.

(Sec. 213) Prohibits this title from being construed to grant DHS any authority to promulgate regulations or set standards relating to the cybersecurity of non-federal entities (excluding state, local, and tribal governments) that were not in effect on the day before the enactment of this title.

(Sec. 214) Terminates reporting requirements under this title seven years after enactment of this title.

(Sec. 216) Requires DHS to deploy and operate (to make available for use by any federal agency, with or without reimbursement) capabilities to protect federal agency information and information systems, including technologies to continuously diagnose, detect, prevent, and mitigate against cybersecurity risks involving such systems. Authorizes the DHS Secretary to access, and allows federal agency heads to disclose to the Secretary, information traveling to or from or stored on a federal agency information system, regardless of from where the Secretary accesses such information, notwithstanding any law that would otherwise restrict or prevent federal agency heads from disclosing such information to the Secretary.

Allows a private entity to assist the Secretary in carrying out such activities.

Authorizes the Secretary to retain, use, and disclose information obtained through the conduct of activities authorized under this section only to protect federal agency information and information systems from cybersecurity risks, or, with DOJ approval and if disclosure of such information is not otherwise prohibited by law, to law enforcement only to investigate, prosecute, disrupt, or otherwise respond to:

 criminal computer fraud; an imminent threat of death or serious bodily harm; a serious threat to a minor, including sexual exploitation or threats to physical safety; or an attempt or conspiracy to commit any of such offenses. Provides liability protections to private entities that provide assistance to the Secretary for such purposes.

(Sec. 217) Terminates the provisions of this title seven years after its enactment.

(Sec. 218) Requires DHS to report to Congress with recommendations to mitigate cybersecurity vulnerabilities for the 10 U.S. ports that are at greatest risk of a cybersecurity incident.

(Sec. 219) Authorizes DHS to consult with sector specific agencies, businesses, and stakeholders to submit to Congress a report on how to align federally funded cybersecurity research and development activities with private sector efforts to protect privacy and civil liberties while assuring security and resilience of the nation's critical infrastructure.

(Sec. 220) Directs the GAO to assess the impact on privacy and civil liberties limited to the work of the NCCIC.

title protecting cyber networks act protecting cyber networks act sec amends national security act require director national_intelligence dni develop promulgate procedures promote timely sharing classified declassified cyber threat indicators possession federal_government private entities non federal_government agencies state tribal local governments sharing imminent ongoing cybersecurity threats entities prevent mitigate adverse impacts requires procedures provide notification entities federal_government shared indicators error contravention law federal_government prior sharing indicators remove personal information information identifying specific person directly related cybersecurity threat directs dni submit procedures congress days enactment title sec permits private entities monitor operate defensive measures prevent mitigate cybersecurity threats security vulnerabilities identify source threat information systems written authorization information systems private government entities authorizes entities conduct activities information stored processed transiting monitored systems prohibits defensive measures destroy render unusable inaccessible substantially harm information system owned operator defensive measure entity authorizes operation defensive measures systems allows non federal entities share receive indicators defensive measures non federal entities specifically designated federal entities authorize non federal entities share directly components department_of_defense dod including national_security_agency nsa allows lawful sharing non federal entities indicators defensive measures dod nsa requires recipients comply lawful restrictions sharing entities place sharing use shared indicators defensive measures requires non federal entities monitoring operating sharing indicators defensive measures implement security controls protect unauthorized access acquisitions prior sharing indicator reasonable efforts remove information non federal entity reasonably believes personal information information identifying specific person directly related cybersecurity threat permits state tribal local agencies use shared indicators defensive measures protect including use defensive measure information system information stored processed transiting information system cybersecurity threat security vulnerability identify source cybersecurity threat respond prosecute prevent mitigate threat death bodily harm offense arising threat respond prevent mitigate threat minor including sexual exploitation threats physical safety requires small_business_administration sba provide assistance small businesses financial institutions monitor information systems operate defensive measures share receive indicators defensive measures directs sba submit president report degree small businesses financial institutions able engage sharing requires federal_government conduct outreach encourage businesses institutions engage activities sec directs president report procedures receipt cyber threat indicators defensive measures federal_government requires procedures ensure cyber threat indicators shared non federal entity department_of_commerce department_of_energy department_of_homeland_security dhs department_of_justice doj department_of_the_treasury dni dod including nsa shared real time appropriate federal entities indicators provided relevant federal entities audit capability appropriate sanctions federal officers employees agents use shared indicators defensive measures unauthorized manner requires doj develop periodically review privacy civil liberties guidelines govern receipt retention use dissemination cyber threat indicators federal entities including guidelines ensure personal information information identifying specific persons properly removed information received retained disseminated federal entity establishes office_of_the_director national_intelligence cyber threat intelligence integration center serve primary organization federal_government analyzing integrating intelligence possessed acquired united_states pertaining cyber threats requires ensure appropriate agencies receive source intelligence support execute cyber threat intelligence activities perform independent alternative analyses disseminate threat analysis president federal agencies congress coordinate federal cyber threat intelligence activities conduct strategic planning requires head appointed dni authorizes indicators defensive measures disclosed retained consistent applicable federal law agency agent federal_government solely protecting information system information stored processed transiting information system cybersecurity threat security vulnerability identifying source cybersecurity threat responding investigating prosecuting preventing mitigating threat death bodily harm offense arising threat responding investigating prosecuting preventing mitigating threat minor including sexual exploitation threats physical safety preventing investigating disrupting prosecuting specified criminal offenses relating fraud identity theft violent felonies espionage censorship trade secrets sec allows person bring private cause action federal_government agency intentionally willfully violates doj privacy civil liberties guidelines sec provides liability protections private entities monitor information systems non federal entities share receive fail good faith act shared indicators defensive measures prohibits liability protections construed apply willful misconduct sec requires reports congress biennially dni implementation federal_government information sharing procedures including assessments misuse information disciplinary actions taken inspectors_general specified agencies receipt use dissemination indicators defensive measures shared federal entities directs privacy_and_civil_liberties_oversight_board years report congress president sufficiency procedures address privacy civil liberties concerns sec directs dni report congress cyber threats attacks theft data breaches assess current intelligence sharing cooperation relationships countries cybersecurity threats national security interests economy intellectual property list countries non state actors primary threats describe response prevention capabilities assess additional technologies enhance capabilities including private sector technologies rapidly fielded assist intelligence_community requires unclassified portions reports title publicly available sec prohibits title construed authorize federal_government conduct surveillance person allow intelligence_community target person surveillance limit lawful disclosures communications records including reporting known suspected criminal activity non federal entity non federal entity federal_government permit federal_government require non federal entity provide information federal_government sec requires government_accountability_office gao report federal actions remove personal information shared cyber threat indicators sec terminates provisions title seven years enactment title national cybersecurity protection advancement act national cybersecurity protection advancement act sec amends homeland_security act allow dhs national cybersecurity communications integration center include tribal governments information sharing analysis centers private entities non federal representatives expands composition include state local governments cybersecurity risks incidents computer emergency readiness team coordinates shares information timely manner provides technical assistance request information system owners operators industrial control system cyber emergency response team coordinates owners operators industrial control systems provides requested training remains current industry adoption new technologies national coordinating center communications coordinates protection response recovery emergency communications coordinator small medium sized businesses sec requires lead federal civilian interface multi directional cross sector sharing information related cyber threat indicators defensive measures cybersecurity risks federal non federal entities expands functions include global cybersecurity international partners information sharing critical infrastructure sectors state major urban area fusion centers small medium sized businesses notification congress significant violations information retention disclosure policies notification non federal entities indicators defensive measures shared error contravention specified requirements participation exercises run dhs national exercise program excludes definition cybersecurity risk violations consumer terms service licensing agreements requires designate agency contact non federal entities directs safeguard cybersecurity information unauthorized disclosure work chief privacy officer follow appropriate privacy procedures requires secretary cybersecurity infrastructure protection secretary develop capabilities use existing industry standards advance implementation automated mechanisms timely sharing indicators defensive measures federal agencies designated sector specific agencies critical infrastructure sectors directs secretary months provide congress progress reports development capabilities authorizes enter voluntary information sharing relationships consenting non federal entities directs secretary develop procedures coordinating vulnerability disclosures consistent international standards allows non federal entities cybersecurity purposes share non federal entities indicators defensive measures obtained information systems information systems federal non federal entities written consent authorizes non federal entities excluding state local tribal governments conduct network awareness scan identify acquire monitor log analyze information operate defensive measures information systems entities provide consent requires entities prior sharing reasonable efforts exclude information identify specific persons unrelated cybersecurity risks incidents safeguard information identify specific persons unintended disclosure unauthorized access acquisition directs secretary establish annually review privacy civil liberties policies governing receipt retention use disclosure cybersecurity information shared provides policies apply dhs allows secretary consult national_institute_of_standards_and_technology policies requires chief privacy officer monitor implementation privacy civil liberties policies update privacy impact assessments regular basis ensure relevant privacy protections followed work secretary carry certain notifications congress non federal entities submit annual report congress effectiveness dhs privacy civil liberties policies ensure appropriate sanctions dhs officers employees agents intentionally willfully conduct activities unauthorized manner directs dhs inspector_general periodically report congress review use cybersecurity risk information shared requires chief privacy officer chief civil rights civil liberties officer biennially submit report congress assesses privacy civil liberties impact dhs retention use disclosure policies recommends methods minimize mitigate impact sharing indicators defensive measures prohibits federal entities shared indicators defensive measures engage surveillance collection activities purpose tracking individual personally identifiable information purposes authorized section bars federal_government information regulatory purposes provides liability protections non federal entities excluding state local tribal governments acting accordance section conduct network awareness share indicators defensive measures fail good faith act based sharing prohibits liability protections construed apply willful misconduct establishes private cause action person bring federal_government federal agency intentionally willfully violates restrictions use protection voluntarily shared indicators defensive measures exempts antitrust laws non federal entities cybersecurity purposes share cyber threat indicators defensive measures assistance relating prevention investigation mitigation cybersecurity risks incidents makes exemption inapplicable price fixing allocating market competitors attempting market exchanges price cost information customer lists information future competitive planning prohibits section construed permit federal_government require non federal entity provide information federal entity requires secretary homeland_security develop procedures director report directly secretary significant cybersecurity risks incidents promote national awareness effort educate general public importance securing information systems directs dhs report congress range efforts underway bolster cybersecurity collaboration relevant international partners sec expands purpose information sharing analysis organizations include responsibilities disseminating information cybersecurity risks incidents sec redesignates dhs national protection programs directorate cybersecurity infrastructure protection requires president appoint secretary advice consent senate deputy secretaries cybersecurity infrastructure protection advice consent senate requires secretary report congress feasibility operational component sec requires secretary regularly update maintain exercise cyber incident annex dhs national response framework sec requires facilitate improvements security resiliency public safety communications directs secretary implement cybersecurity awareness campaign disseminate public service announcements targeted state local tribal governments private sector academia stakeholders specific audiences including elderly students small businesses members armed_forces veterans vendor technology neutral voluntary best practices requires dhs establish national cybersecurity preparedness consortium train state local responders officials prepare respond cyber attacks develop curriculum utilizing dhs sponsored community cyber security maturity model provide technical assistance conduct cybersecurity training simulation exercises coordinate help states communities develop information sharing programs coordinate national domestic preparedness consortium incorporate cybersecurity emergency responses existing state local emergency management functions sec directs secretary science_and_technology biennially provide congress updated strategic plan guide overall direction federal physical security cybersecurity technology research development efforts protecting critical infrastructure requires plan identify critical infrastructure security risks associated security technology gaps prioritize technology needs based gaps risks evolving threats technology advancements include research development acquisition roadmaps clearly defined objectives goals measures identify laboratories facilities modeling simulation capabilities required support new technologies identify programmatic initiatives rapid advancement deployment security technologies critical infrastructure protection including public private partnerships collaboration university centers_of_excellence national_laboratory technology transfers sec requires dhs report congress feasibility dhs reducing cybersecurity risks dhs data centers including increasing systems providing mix security controls compartments sec directs gao report dhs implementation title including findings increases sharing united_states sec requires secretary produce report feasibility creating risk informed prioritization plan multiple critical infrastructures experience cyber incidents simultaneously sec directs dhs inspector_general review operations computer emergency readiness team industrial control systems cyber emergency response team assess capacity provide technical assistance non federal entities adequately respond potential increases requests technical assistance sec prohibits title construed grant dhs authority promulgate regulations set standards relating cybersecurity non federal entities excluding state local tribal governments effect day enactment title sec terminates reporting requirements title seven years enactment title sec requires dhs deploy operate available use federal agency reimbursement capabilities protect federal agency information information systems including technologies continuously diagnose detect prevent mitigate cybersecurity risks involving systems authorizes dhs secretary access allows federal agency heads disclose secretary information traveling stored federal agency information system regardless secretary accesses information notwithstanding law restrict prevent federal agency heads disclosing information secretary allows private entity assist secretary carrying activities authorizes secretary retain use disclose information obtained conduct activities authorized section protect federal agency information information systems cybersecurity risks doj approval disclosure information prohibited law law enforcement investigate prosecute disrupt respond criminal computer fraud imminent threat death bodily harm threat minor including sexual exploitation threats physical safety attempt conspiracy commit offenses provides liability protections private entities provide assistance secretary purposes sec terminates provisions title seven years enactment sec requires dhs report congress recommendations mitigate cybersecurity vulnerabilities ports greatest risk cybersecurity incident sec authorizes dhs consult sector specific agencies businesses stakeholders submit congress report align federally funded cybersecurity research development activities private sector efforts protect privacy civil liberties assuring security resilience nation critical infrastructure sec directs gao assess impact privacy civil liberties limited work


Summary:
Personal Data Notification and Protection Act of 2015

Requires certain businesses that use, access, transmit, store, dispose of, or collect sensitive personally identifiable information about more than 10,000 individuals during any 12-month period to notify individuals whose information is believed to have been accessed or acquired through a discovered security breach.

Directs businesses, within 30 days after discovery of a breach, to notify: (1) affected individuals by mail, telephone, or email; and (2) major media outlets if the number of affected residents of a state exceeds 5,000. Allows the Federal Trade Commission (FTC) to extend the notification period if a business seeks additional time.

Requires the Department of Homeland Security (DHS) to designate a federal government entity to receive notices about security incidents, threats, and vulnerabilities. Directs businesses to notify the DHS-designated entity, and requires the DHS-designated entity to then notify the U.S. Secret Service, the Federal Bureau of Investigation (FBI), and the FTC, if a security breach affects: (1) more than 5,000 individuals, (2) a database that contains the sensitive information of more than 500,000 individuals, (3) federal government databases, or (4) federal employees or contractors involved in national security or law enforcement. Requires the DHS-designated entity to also make the information available to other appropriate federal agencies for law enforcement, national security, or computer security purposes.

Authorizes the Secret Service or the FBI to require businesses to delay or exempt individuals from notifications for national security or law enforcement purposes.

Requires businesses to notify consumer reporting agencies if more than 5,000 individuals must be notified of a breach.

Exempts a business from individual notification requirements if the business: (1) conducts and notifies the FTC of a risk assessment finding no reasonable risk that a breach resulted in, or will result in, harm to the affected individuals, provided that the FTC is given 10 days to determine whether individual notification should be provided before the exemption automatically becomes effective; or (2) uses or participates in a security program that blocks the use of certain sensitive personal information to initiate financial transactions if the program also notifies affected individuals after a breach that results in fraud or unauthorized transactions.

Sets forth authority for the FTC and states to enforce against violations of this Act.

Amends the federal criminal code to extend extraterritorially the application of penalties for fraud offenses involving an access device issued, owned, managed, or controlled by a financial institution, credit card system member, or other entity organized under the laws of the United States or any U.S. state or territory. (An access device is any card, code, electronic serial number, telecommunications service, or other means of account access that can be used to initiate a transfer of funds or to obtain money, goods, or services.) Removes a condition under current law that subjects a person to such penalties only if the underlying articles, property, or proceeds are held within or have transferred through U.S. jurisdiction.

personal data notification protection act requires certain businesses use access transmit store dispose collect sensitive personally identifiable information individuals month period notify individuals information believed accessed acquired discovered security breach directs businesses days discovery breach notify affected individuals mail telephone email major media outlets number affected residents state exceeds allows federal_trade_commission ftc extend notification period business seeks additional time requires department_of_homeland_security dhs designate federal_government entity receive notices security incidents threats vulnerabilities directs businesses notify dhs designated entity requires dhs designated entity notify secret_service federal_bureau_of_investigation fbi ftc security breach affects individuals database contains sensitive information individuals federal_government databases federal employees contractors involved national security law enforcement requires dhs designated entity information available appropriate federal agencies law enforcement national security computer security purposes authorizes secret_service fbi require businesses delay exempt individuals notifications national security law enforcement purposes requires businesses notify consumer reporting agencies individuals notified breach exempts business individual notification requirements business conducts notifies ftc risk assessment finding reasonable risk breach resulted result harm affected individuals provided ftc given days determine individual notification provided exemption automatically effective uses participates security program blocks use certain sensitive personal information initiate financial transactions program notifies affected individuals breach results fraud unauthorized transactions sets forth authority ftc states enforce violations act amends federal criminal code extend application penalties fraud offenses involving access device issued owned managed controlled financial institution credit card system member entity organized laws united_states state territory access device card code electronic serial number telecommunications service means account access initiate transfer funds obtain money goods services removes condition current law subjects person penalties underlying articles property proceeds held transferred jurisdiction


Summary:
National Cybersecurity Protection Advancement Act of 2015

(Sec. 2) Amends the Homeland Security Act of 2002 to allow the Department of Homeland Security's (DHS's) national cybersecurity and communications integration center (NCCIC) to include tribal governments, information sharing and analysis centers, and private entities among its non-federal representatives. Expands the composition of the NCCIC to include:

 a collaborator with state and local governments on cybersecurity risks and incidents; a U.S. Computer Emergency Readiness Team that coordinates and shares information in a timely manner and provides technical assistance, upon request, to information system owners and operators; the Industrial Control System Cyber Emergency Response Team that coordinates with owners and operators of industrial control systems, provides requested training, and remains current on industry adoption of new technologies; a National Coordinating Center for Communications that coordinates the protection, response, and recovery of emergency communications; and a coordinator of small and medium-sized businesses. (Sec. 3) Requires the NCCIC to be the lead federal civilian interface for multi-directional and cross-sector sharing of information related to cyber threat indicators, defensive measures, and cybersecurity risks for federal and non-federal entities. Expands the NCCIC's functions to include:

 global cybersecurity with international partners; information sharing across critical infrastructure sectors, with state and major urban area fusion centers and with small and medium-sized businesses; notification to Congress regarding any significant violations of information retention or disclosure policies; notification to non-federal entities of indicators or defensive measures shared in error or in contravention of specified requirements; and participation in exercises run by DHS's National Exercise Program. Excludes from the definition of "cybersecurity risk" violations of consumer terms of service or licensing agreements.

Requires the NCCIC to designate an agency contact for non-federal entities.

Directs the NCCIC to: (1) safeguard cybersecurity information against unauthorized disclosure, and (2) work with the Chief Privacy Officer to follow appropriate privacy procedures.

Requires the Under Secretary for Cybersecurity and Infrastructure Protection (the Under Secretary) to develop capabilities that make use of existing industry standards to advance implementation of automated mechanisms for the timely sharing of indicators and defensive measures to and from the NCCIC and with federal agencies designated as sector specific agencies for critical infrastructure sectors.

Directs the Under Secretary, every six months, to provide Congress with progress reports regarding the development of such capabilities.

Authorizes the NCCIC to enter voluntary information sharing relationships with consenting non-federal entities.

Directs the Under Secretary to develop procedures for coordinating vulnerability disclosures consistent with international standards.

Allows non-federal entities, for cybersecurity purposes, to share with other non-federal entities or the NCCIC any indicators or defensive measures obtained from: (1) their own information systems; or (2) the information systems of other federal or non-federal entities, with written consent. Authorizes non-federal entities (excluding state, local, or tribal governments) to conduct network awareness to scan, identify, acquire, monitor, log, or analyze information, or to operate defensive measures, on the information systems of entities that provide consent.

Requires entities, prior to sharing, to take reasonable efforts to: (1) exclude information that can be used to identify specific persons and that is unrelated to cybersecurity risks or incidents, and (2) safeguard information that can be used to identify specific persons from unintended disclosure or unauthorized access or acquisition.

Directs the Under Secretary to establish and annually review privacy and civil liberties policies governing the receipt, retention, use, and disclosure of cybersecurity information shared with the NCCIC. Provides for such policies to apply only to DHS. Allows the Under Secretary to consult with the National Institute of Standards and Technology on such policies.

Requires the Chief Privacy Officer to:

 monitor implementation of such privacy and civil liberties policies; update privacy impact assessments on a regular basis to ensure that all relevant privacy protections are followed; work with the Under Secretary to carry out certain notifications to Congress and non-federal entities; submit an annual report to Congress regarding the effectiveness of DHS's privacy and civil liberties policies; and ensure appropriate sanctions for DHS officers, employees, or agents who intentionally or willfully conduct activities in an unauthorized manner. Directs the DHS Inspector General to periodically report to Congress with a review of the use of cybersecurity risk information shared with the NCCIC.

Requires the Chief Privacy Officer and the Chief Civil Rights and Civil Liberties Officer to biennially submit a report to Congress that: (1) assesses the privacy and civil liberties impact of DHS's retention, use, and disclosure policies; and (2) recommends methods to minimize or mitigate the impact of sharing indicators and defensive measures.

Prohibits federal entities from using shared indicators or defensive measures to engage in surveillance or other collection activities for the purpose of tracking an individual's personally identifiable information, except for purposes authorized under this section. Bars the federal government from using such information for regulatory purposes.

Provides liability protections to non-federal entities (excluding state, local, or tribal governments) acting in accordance with this section that: (1) conduct network awareness, or (2) share indicators or defensive measures or that fail, in good faith, to act based on such sharing.

Prohibits such liability protections from being construed to apply to willful misconduct.

Establishes a private cause of action that a person may bring against the federal government if a federal agency intentionally or willfully violates restrictions on the use and protection of voluntarily shared indicators or defensive measures.

Exempts from antitrust laws non-federal entities that, for cybersecurity purposes, share: (1) cyber threat indicators or defensive measures; or (2) assistance relating to the prevention, investigation, or mitigation of cybersecurity risks or incidents. Makes such exemption inapplicable to price-fixing, allocating a market between competitors, monopolizing or attempting to monopolize a market, or exchanges of price or cost information, customer lists, or information regarding future competitive planning.

Prohibits this section from being construed to permit the federal government to require a non-federal entity to provide information to a federal entity.

Requires the Secretary of Homeland Security to: (1) develop procedures for the NCCIC Director to report directly to the Secretary regarding significant cybersecurity risks and incidents, and (2) promote a national awareness effort to educate the general public on the importance of securing information systems.

Directs DHS to report to Congress on the range of efforts underway to bolster cybersecurity collaboration with relevant international partners.

(Sec. 4) Expands the purpose of information sharing and analysis organizations to include responsibilities for disseminating information about cybersecurity risks and incidents.

(Sec. 5) Redesignates DHS's National Protection and Programs Directorate as the Cybersecurity and Infrastructure Protection. Requires the President to appoint: (1) the Under Secretary, with the advice and consent of the Senate; and (2) the Deputy Under Secretaries for Cybersecurity and for Infrastructure Protection, without the advice and consent of the Senate. Requires the Under Secretary to report to Congress regarding the feasibility of becoming an operational component.

(Sec. 6) Requires the Secretary to regularly update, maintain, and exercise the Cyber Incident Annex to DHS's National Response Framework.

(Sec. 7) Requires the NCCIC to facilitate improvements to the security and resiliency of public safety communications.

Directs the Under Secretary to implement a cybersecurity awareness campaign to disseminate: (1) public service announcements targeted at state, local, and tribal governments, the private sector, academia, and stakeholders in specific audiences, including the elderly, students, small businesses, members of the Armed Forces, and veterans; and (2) vendor and technology-neutral voluntary best practices.

Requires DHS to establish a National Cybersecurity Preparedness Consortium to:

 train state and local first responders and officials to prepare for and respond to cyber attacks, develop a curriculum utilizing the DHS-sponsored Community Cyber Security Maturity Model, provide technical assistance, conduct cybersecurity training and simulation exercises, coordinate with the NCCIC to help states and communities develop information sharing programs, and coordinate with the National Domestic Preparedness Consortium to incorporate cybersecurity emergency responses into existing state and local emergency management functions. (Sec. 8) Directs the Under Secretary for Science and Technology to biennially provide to Congress an updated strategic plan to guide the overall direction of federal physical security and cybersecurity technology research and development efforts for protecting critical infrastructure. Requires the plan to:

 identify critical infrastructure security risks and any associated security technology gaps; prioritize technology needs based on gaps, risks, evolving threats, and technology advancements; include research, development, and acquisition roadmaps with clearly defined objectives, goals, and measures; identify laboratories, facilities, modeling, and simulation capabilities required to support new technologies; and identify programmatic initiatives for the rapid advancement and deployment of security technologies for critical infrastructure protection, including public-private partnerships, intragovernment collaboration, university centers of excellence, and national laboratory technology transfers. (Sec. 9) Requires DHS to report to Congress regarding the feasibility of DHS reducing cybersecurity risks in DHS data centers, including by increasing compartmentalization between systems and providing a mix of security controls between such compartments.

(Sec. 10) Directs the Government Accountability Office (GAO) to report on DHS's implementation of this Act, including any findings regarding increases in sharing at the NCCIC and throughout the United States.

(Sec. 11) Requires the Under Secretary to produce a report on the feasibility of creating a risk-informed prioritization plan should multiple critical infrastructures experience cyber incidents simultaneously.

(Sec. 12) Directs the DHS Inspector General to review operations of the U.S. Computer Emergency Readiness Team and the Industrial Control Systems Cyber Emergency Response Team to assess the capacity to provide technical assistance to non-federal entities and to adequately respond to potential increases in requests for technical assistance.

(Sec. 13) Prohibits this Act from being construed to grant DHS any authority to promulgate regulations or set standards relating to the cybersecurity of non-federal entities (excluding state, local, and tribal governments) that were not in effect on the day before the enactment of this Act.

(Sec. 14) Terminates reporting requirements under this Act seven years after enactment of this Act.

(Sec. 16) Requires DHS to deploy and operate (to make available for use by any federal agency, with or without reimbursement) capabilities to protect federal agency information and information systems, including technologies to continuously diagnose, detect, prevent, and mitigate against cybersecurity risks involving such systems. Authorizes the DHS Secretary to access, and allows federal agency heads to disclose to the Secretary, information traveling to or from or stored on a federal agency information system, regardless of from where the Secretary accesses such information, notwithstanding any law that would otherwise restrict or prevent federal agency heads from disclosing such information to the Secretary.

Allows a private entity to assist the Secretary in carrying out such activities.

Authorizes the Secretary to retain, use, and disclose information obtained through the conduct of activities authorized under this section only to protect federal agency information and information systems from cybersecurity risks, or, with DOJ approval and if disclosure of such information is not otherwise prohibited by law, to law enforcement only to investigate, prosecute, disrupt, or otherwise respond to:

 criminal computer fraud; an imminent threat of death or serious bodily harm; a serious threat to a minor, including sexual exploitation or threats to physical safety; or an attempt or conspiracy to commit any of such offenses. Provides liability protections to private entities that provide assistance to the Secretary for such purposes.

(Sec. 17) Terminates the provisions of this Act seven years after its enactment.

(Sec. 18) Requires DHS to report to Congress with recommendations to mitigate cybersecurity vulnerabilities for the 10 U.S. ports that are at greatest risk of a cybersecurity incident.

(Sec. 19) Authorizes DHS to consult with sector specific agencies, businesses, and stakeholders to submit to Congress a report on how to align federally funded cybersecurity research and development activities with private sector efforts to protect privacy and civil liberties while assuring security and resilience of the nation's critical infrastructure.

(Sec. 20) Directs the GAO to assess the impact on privacy and civil liberties limited to the work of the NCCIC.

national cybersecurity protection advancement act sec amends homeland_security act allow department_of_homeland_security dhs national cybersecurity communications integration center include tribal governments information sharing analysis centers private entities non federal representatives expands composition include state local governments cybersecurity risks incidents computer emergency readiness team coordinates shares information timely manner provides technical assistance request information system owners operators industrial control system cyber emergency response team coordinates owners operators industrial control systems provides requested training remains current industry adoption new technologies national coordinating center communications coordinates protection response recovery emergency communications coordinator small medium sized businesses sec requires lead federal civilian interface multi directional cross sector sharing information related cyber threat indicators defensive measures cybersecurity risks federal non federal entities expands functions include global cybersecurity international partners information sharing critical infrastructure sectors state major urban area fusion centers small medium sized businesses notification congress significant violations information retention disclosure policies notification non federal entities indicators defensive measures shared error contravention specified requirements participation exercises run dhs national exercise program excludes definition cybersecurity risk violations consumer terms service licensing agreements requires designate agency contact non federal entities directs safeguard cybersecurity information unauthorized disclosure work chief privacy officer follow appropriate privacy procedures requires secretary cybersecurity infrastructure protection secretary develop capabilities use existing industry standards advance implementation automated mechanisms timely sharing indicators defensive measures federal agencies designated sector specific agencies critical infrastructure sectors directs secretary months provide congress progress reports development capabilities authorizes enter voluntary information sharing relationships consenting non federal entities directs secretary develop procedures coordinating vulnerability disclosures consistent international standards allows non federal entities cybersecurity purposes share non federal entities indicators defensive measures obtained information systems information systems federal non federal entities written consent authorizes non federal entities excluding state local tribal governments conduct network awareness scan identify acquire monitor log analyze information operate defensive measures information systems entities provide consent requires entities prior sharing reasonable efforts exclude information identify specific persons unrelated cybersecurity risks incidents safeguard information identify specific persons unintended disclosure unauthorized access acquisition directs secretary establish annually review privacy civil liberties policies governing receipt retention use disclosure cybersecurity information shared provides policies apply dhs allows secretary consult national_institute_of_standards_and_technology policies requires chief privacy officer monitor implementation privacy civil liberties policies update privacy impact assessments regular basis ensure relevant privacy protections followed work secretary carry certain notifications congress non federal entities submit annual report congress effectiveness dhs privacy civil liberties policies ensure appropriate sanctions dhs officers employees agents intentionally willfully conduct activities unauthorized manner directs dhs inspector_general periodically report congress review use cybersecurity risk information shared requires chief privacy officer chief civil rights civil liberties officer biennially submit report congress assesses privacy civil liberties impact dhs retention use disclosure policies recommends methods minimize mitigate impact sharing indicators defensive measures prohibits federal entities shared indicators defensive measures engage surveillance collection activities purpose tracking individual personally identifiable information purposes authorized section bars federal_government information regulatory purposes provides liability protections non federal entities excluding state local tribal governments acting accordance section conduct network awareness share indicators defensive measures fail good faith act based sharing prohibits liability protections construed apply willful misconduct establishes private cause action person bring federal_government federal agency intentionally willfully violates restrictions use protection voluntarily shared indicators defensive measures exempts antitrust laws non federal entities cybersecurity purposes share cyber threat indicators defensive measures assistance relating prevention investigation mitigation cybersecurity risks incidents makes exemption inapplicable price fixing allocating market competitors attempting market exchanges price cost information customer lists information future competitive planning prohibits section construed permit federal_government require non federal entity provide information federal entity requires secretary homeland_security develop procedures director report directly secretary significant cybersecurity risks incidents promote national awareness effort educate general public importance securing information systems directs dhs report congress range efforts underway bolster cybersecurity collaboration relevant international partners sec expands purpose information sharing analysis organizations include responsibilities disseminating information cybersecurity risks incidents sec redesignates dhs national protection programs directorate cybersecurity infrastructure protection requires president appoint secretary advice consent senate deputy secretaries cybersecurity infrastructure protection advice consent senate requires secretary report congress feasibility operational component sec requires secretary regularly update maintain exercise cyber incident annex dhs national response framework sec requires facilitate improvements security resiliency public safety communications directs secretary implement cybersecurity awareness campaign disseminate public service announcements targeted state local tribal governments private sector academia stakeholders specific audiences including elderly students small businesses members armed_forces veterans vendor technology neutral voluntary best practices requires dhs establish national cybersecurity preparedness consortium train state local responders officials prepare respond cyber attacks develop curriculum utilizing dhs sponsored community cyber security maturity model provide technical assistance conduct cybersecurity training simulation exercises coordinate help states communities develop information sharing programs coordinate national domestic preparedness consortium incorporate cybersecurity emergency responses existing state local emergency management functions sec directs secretary science_and_technology biennially provide congress updated strategic plan guide overall direction federal physical security cybersecurity technology research development efforts protecting critical infrastructure requires plan identify critical infrastructure security risks associated security technology gaps prioritize technology needs based gaps risks evolving threats technology advancements include research development acquisition roadmaps clearly defined objectives goals measures identify laboratories facilities modeling simulation capabilities required support new technologies identify programmatic initiatives rapid advancement deployment security technologies critical infrastructure protection including public private partnerships collaboration university centers_of_excellence national_laboratory technology transfers sec requires dhs report congress feasibility dhs reducing cybersecurity risks dhs data centers including increasing systems providing mix security controls compartments sec directs government_accountability_office gao report dhs implementation act including findings increases sharing united_states sec requires secretary produce report feasibility creating risk informed prioritization plan multiple critical infrastructures experience cyber incidents simultaneously sec directs dhs inspector_general review operations computer emergency readiness team industrial control systems cyber emergency response team assess capacity provide technical assistance non federal entities adequately respond potential increases requests technical assistance sec prohibits act construed grant dhs authority promulgate regulations set standards relating cybersecurity non federal entities excluding state local tribal governments effect day enactment act sec terminates reporting requirements act seven years enactment act sec requires dhs deploy operate available use federal agency reimbursement capabilities protect federal agency information information systems including technologies continuously diagnose detect prevent mitigate cybersecurity risks involving systems authorizes dhs secretary access allows federal agency heads disclose secretary information traveling stored federal agency information system regardless secretary accesses information notwithstanding law restrict prevent federal agency heads disclosing information secretary allows private entity assist secretary carrying activities authorizes secretary retain use disclose information obtained conduct activities authorized section protect federal agency information information systems cybersecurity risks doj approval disclosure information prohibited law law enforcement investigate prosecute disrupt respond criminal computer fraud imminent threat death bodily harm threat minor including sexual exploitation threats physical safety attempt conspiracy commit offenses provides liability protections private entities provide assistance secretary purposes sec terminates provisions act seven years enactment sec requires dhs report congress recommendations mitigate cybersecurity vulnerabilities ports greatest risk cybersecurity incident sec authorizes dhs consult sector specific agencies businesses stakeholders submit congress report align federally funded cybersecurity research development activities private sector efforts protect privacy civil liberties assuring security resilience nation critical infrastructure sec directs gao assess impact privacy civil liberties limited work


Summary:
Executive Cyberspace Coordination Act of 2015

This bill establishes the National Office for Cyberspace within the Executive Office of the President, to be headed by a Director. The Office shall serve as the principal office for coordinating issues relating to cyberspace, including achieving an assured, reliable, secure, and survivable information infrastructure while promoting national economic interests, security, and civil liberties. The bill defines "information infrastructure" as the underlying framework that information systems and assets rely on to process, store, or transmit information electronically.

The bill assigns new duties to the Director, including: (1) reviewing at least annually, and approving or disapproving, agency information security programs; (2) coordinating information security training for federal employees with the Office of Personnel Management; and (3) ensuring the adequacy of protections for privacy and civil liberties. The head of each agency must submit to the Director an annual budget relating to the protection of information infrastructure for the agency, which shall include a review of any threats to information technology for such agency and a plan to secure the information infrastructure for such agency based on threats to information technology.

executive cyberspace coordination act bill establishes national office cyberspace executive_office president headed director office shall serve principal office coordinating issues relating cyberspace including achieving assured reliable secure information infrastructure promoting national economic interests security civil liberties bill defines information infrastructure underlying framework information systems assets rely process store transmit information electronically bill assigns new duties director including reviewing annually approving disapproving agency information security programs coordinating information security training federal employees office_of_personnel_management ensuring adequacy protections privacy civil liberties head agency submit director annual budget relating protection information infrastructure agency shall include review threats information technology agency plan secure information infrastructure agency based threats information technology


Summary:
United States Chief Technology Officer Act

Amends the National Science and Technology Policy, Organization, and Priorities Act of 1976 to authorize the President to appoint a United States Chief Technology Officer whose duties shall include advising the President and the Director of the Office of Science and Technology Policy on federal information systems, technology, data, and innovation policies and initiatives.

united_states chief technology officer act amends national science_and_technology policy organization priorities act authorize president appoint united_states chief technology officer duties shall include advising president director office_of_science_and_technology_policy federal information systems technology data innovation policies initiatives


Summary:
Smartphone Theft Prevention Act of 2015

Amends the Communications Act of 1934 to require commercial mobile service providers to make available on smartphones, in coordination with smartphone manufacturers and operating system providers, a function that an account holder may use remotely to: (1) delete or render inaccessible all information on the smartphone relating to the account holder, (2) render the smartphone inoperable on the global networks of such service providers, (3) prevent reactivation or reprogramming without a passcode or similar authorization after the smartphone has been rendered inoperable or has been subject to an unauthorized factory reset, and (4) restore personal information from the smartphone onto a compatible or interoperable device.

Requires service providers to ensure that smartphones: (1) prompt the account holder to enable such functions during the initial setup process, and (2) allow only the account holder to opt out.

Prohibits a smartphone from being manufactured in the United States or imported into the United States for sale or resale to the public, unless the smartphone is configured in such a manner that a service provider may comply with such functionality requirements.

Prohibits service providers from charging a fee for making available such functions, the initial prompt, and the ability to opt out.

Directs the Federal Communications Commission (FCC) to establish a common national framework for smartphone anti-theft measures to protect consumers.

Requires the FCC to determine whether this Act should apply to tablets with commercial mobile services.

theft prevention act amends communications act require commercial mobile service providers available coordination manufacturers operating system providers function account holder use remotely delete render inaccessible information relating account holder render inoperable global networks service providers prevent reactivation reprogramming similar authorization rendered inoperable subject unauthorized factory reset restore personal information compatible interoperable device requires service providers ensure prompt account holder enable functions initial process allow account holder opt prohibits manufactured united_states imported united_states sale resale public configured manner service provider comply functionality requirements prohibits service providers charging fee making available functions initial prompt ability opt directs federal_communications_commission fcc establish common national framework anti theft measures protect consumers requires fcc determine act apply tablets commercial mobile services


Summary:
United States Commission on an Open Society with Security Act of 2015

Establishes the United States Commission on an Open Society with Security to study how the government may provide for both security in, and public access to, federal buildings and other federal property and sites.

Directs the Commission to examine: (1) government and private security practices and proposals, building design, public space management, counterterrorism needs, and refurbishment of existing federal facilities; (2) the effect of access to public facilities and spaces on free speech, the right to petition the government, other constitutional rights and civil liberties, economies of affected jurisdictions, architectural aesthetics, traffic and congestion, and employee job performance; (3) technology to augment or replace traditional modes of security; and (4) methods of assessing the risks posed by terrorism, balanced against the needs and values of open access.

united_states_commission open society security act establishes united_states_commission open society security study government provide security public access federal buildings federal property sites directs commission examine government private security practices proposals building design public space management counterterrorism needs refurbishment existing federal facilities effect access public facilities spaces free speech right petition government constitutional rights civil liberties economies affected jurisdictions architectural traffic congestion employee job performance technology augment replace traditional modes security methods assessing risks posed terrorism balanced needs values open access


Summary:
Defending Internet Freedom Act of 2015

Prohibits the Assistant Secretary of Commerce for Communications and Information from relinquishing the responsibilities of the National Telecommunications and Information Administration (NTIA) with respect to Internet domain name functions, including Internet Assigned Numbers Authority (IANA) functions, unless the Assistant Secretary certifies to Congress that a final proposal has been received that ensures:

 control over the management of the Internet domain name system will not be exercised by a governmental or intergovernmental body; standards for freedoms of speech, of the press, of assembly, and of association are at least as protective as the First Amendment to the U.S. Constitution; the Internet Corporation for Assigned Names and Numbers (ICANN) has an external, independent process for reviewing and resolving disputes between ICANN and external parties, including the ability to reverse decisions of the board of directors; ICANN remains subject to U.S. law; ICANN has adopted disclosure procedures that are at least as protective of public access as the Freedom of Information Act; the U.S. government has been granted ownership of the ".gov" and ".mil" top-level domains; and ICANN has adopted additional measures recommended by the multistakeholder community. Requires such certification to ensure amendments to ICANN bylaws to prohibit ICANN from: (1) engaging in activities unrelated to ICANN's core mission of managing the IANA functions and proposing and overseeing policy decisions central to coordinating the global interoperability and uniqueness of Internet domain names; or (2) agreeing to impose on a registrar or registry any condition, such as a regulation of content, that is unrelated to ICANN's core mission.

Requires such a certification to also ensure amendments to bylaws concerning: (1) Governmental Advisory Committee advice and policy proposals, and (2) a required supermajority of the board of directors for votes regarding changes to bylaws.

Directs the Assistant Secretary, if such a certification is not submitted to Congress by a specified deadline, to extend through September 30, 2017, the existing IANA functions contract under which ICANN is required to perform IANA functions.

defending internet freedom act prohibits assistant secretary commerce_for_communications_and_information relinquishing responsibilities national_telecommunications_and_information_administration ntia respect internet domain functions including internet assigned numbers authority functions assistant secretary certifies congress final proposal received ensures control management internet domain system exercised governmental intergovernmental body standards freedoms speech press assembly association protective amendment constitution internet corporation assigned names numbers external independent process reviewing resolving disputes external parties including ability reverse decisions board_of_directors remains subject law adopted disclosure procedures protective public access freedom information act government granted ownership level domains adopted additional measures recommended community requires certification ensure amendments bylaws prohibit engaging activities unrelated core mission managing functions proposing overseeing policy decisions central coordinating global interoperability internet domain names agreeing impose registrar registry condition regulation content unrelated core mission requires certification ensure amendments bylaws concerning governmental advisory_committee advice policy proposals required board_of_directors votes changes bylaws directs assistant secretary certification submitted congress specified deadline extend september existing functions contract required perform functions


Summary:
(This measure has not been amended since it was reported to the House on March 30, 2016. The summary of that version is repeated here.)

No Rate Regulation of Broadband Internet Access Act

(Sec. 2) This bill prohibits the Federal Communications Commission (FCC) from regulating the rates charged for broadband Internet access service.

(Sec. 3) Nothing in this Act shall be construed to affect the FCC's authority to: (1) condition receipt of universal service support by a provider of broadband Internet access service on the regulation of the rates charged by such provider for the supported service, or (2) enforce regulations relating to truth-in-billing requirements or paid prioritization.

(Sec. 4) Broadband Internet access service shall not be construed to include data roaming or interconnection for purposes of this Act.

measure amended reported house march summary version repeated rate regulation broadband internet access act sec bill prohibits federal_communications_commission fcc regulating rates charged broadband internet access service sec act shall construed affect fcc authority condition receipt universal service support provider broadband internet access service regulation rates charged provider supported service enforce regulations relating truth billing requirements paid prioritization sec broadband internet access service shall construed include data roaming interconnection purposes act


Summary: Requires the Director of National Intelligence to carry out a study and report findings to Congress regarding appropriate standards to measure the damage of cyber incidents for purposes of determining the response to such incidents, including a method to quantify damage to affected computers, systems, and devices.

requires director national_intelligence carry study report findings congress appropriate standards measure damage cyber incidents purposes determining response incidents including method quantify damage affected computers systems devices


Summary:
EINSTEIN Act of 2015

Amends the Homeland Security Act of 2002 to require the Department of Homeland Security (DHS) to deploy, operate, and maintain (to make available for use by any federal agency, with or without reimbursement) capabilities to protect federal agency information and federal civilian information systems, including technologies to continuously diagnose, detect, prevent, and mitigate against cybersecurity risks involving such information or systems.

Authorizes the DHS Secretary to access, and allows federal agency heads to disclose to the Secretary, information traveling to or from or stored on such systems, regardless of from where the Secretary accesses such information, notwithstanding any law that would otherwise restrict or prevent such disclosures.

Authorizes the Secretary to retain, use, and disclose information obtained through such activities only to protect federal agency information and federal civilian information systems from cybersecurity risks or in furtherance of the national cybersecurity and communications integration center's (NCCIC's) authority, or, with DOJ approval and if disclosure of such information is not otherwise prohibited by law, to law enforcement only to investigate, prosecute, disrupt, or otherwise respond to:

 criminal computer fraud; an imminent threat of death or serious bodily harm; a serious threat to a minor, including sexual exploitation or threats to physical safety; or an attempt or conspiracy to commit any of such offenses. Provides liability protections to private entities authorized to assist the Secretary for such purposes.

Redefines for purposes of the NCCIC's cybersecurity functions: (1) "cybersecurity risk" to exclude actions that solely involve a violation of a consumer term of service or a consumer licensing agreement; and (2) "incident" to include an occurrence that actually or imminently jeopardizes, without lawful authority, an information system, thereby replacing a standard that includes occurrences that constitute a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

act amends homeland_security act require department_of_homeland_security dhs deploy operate maintain available use federal agency reimbursement capabilities protect federal agency information federal civilian information systems including technologies continuously diagnose detect prevent mitigate cybersecurity risks involving information systems authorizes dhs secretary access allows federal agency heads disclose secretary information traveling stored systems regardless secretary accesses information notwithstanding law restrict prevent disclosures authorizes secretary retain use disclose information obtained activities protect federal agency information federal civilian information systems cybersecurity risks furtherance national cybersecurity communications integration center authority doj approval disclosure information prohibited law law enforcement investigate prosecute disrupt respond criminal computer fraud imminent threat death bodily harm threat minor including sexual exploitation threats physical safety attempt conspiracy commit offenses provides liability protections private entities authorized assist secretary purposes redefines purposes cybersecurity functions cybersecurity risk exclude actions solely involve violation consumer term service consumer licensing agreement incident include occurrence actually imminently jeopardizes lawful authority information system replacing standard includes occurrences constitute violation imminent threat violation law security policies security procedures acceptable use policies


Summary:
Strengthening State and Local Cyber Crime Fighting Act

(Sec. 2) This bill amends the Homeland Security Act of 2002 to establish in the Department of Homeland Security (DHS) a National Computer Forensics Institute to be operated by the U.S. Secret Service to: (1)  disseminate homeland security information related to the investigation and prevention of cyber and electronic crimes and related threats; and (2) educate, train, and provide equipment to state, local, tribal, and territorial law enforcement officers, prosecutors, and judges to carry out investigations, prosecutions, and court proceeding relating to such crimes and threats.

The institute:

 must provide education and training on investigation methods, computer and mobile device forensic examinations, network intrusion incidents, and methods to obtain, process, store, and admit digital evidence in court; must ensure that timely, actionable, and relevant expertise and homeland security information related to cyber and electronic crimes and threats is shared with such officers, prosecutors, and judges; and may provide officers, prosecutors, and judges with computer equipment and tools for such investigations and examinations. The Secret Service's network of Electronic Crime Task Forces is to be expanded through the addition of task force officers, prosecutors, and judges educated and trained at the institute, in addition to academia and private sector stakeholders.

The institute must seek opportunities to coordinate with the Federal Law Enforcement Training Center within DHS to help enhance the center's training for such cyber and electronic crimes and threats.

strengthening state local cyber crime fighting act sec bill amends homeland_security act establish department_of_homeland_security dhs national computer forensics institute operated secret_service disseminate homeland_security information related investigation prevention cyber electronic crimes related threats educate train provide equipment state local tribal territorial law enforcement officers prosecutors judges carry investigations prosecutions court proceeding relating crimes threats institute provide education training investigation methods computer mobile device forensic examinations network intrusion incidents methods obtain process store admit digital evidence court ensure timely actionable relevant expertise homeland_security information related cyber electronic crimes threats shared officers prosecutors judges provide officers prosecutors judges computer equipment tools investigations examinations secret_service network electronic crime task forces expanded addition task_force officers prosecutors judges educated trained institute addition academia private sector stakeholders institute seek opportunities coordinate federal_law_enforcement_training_center dhs help enhance center training cyber electronic crimes threats


Summary:
State and Local Cyber Protection Act of 2015

(Sec. 2) This bill amends the Homeland Security Act of 2002 to require the Department of Homeland Security's (DHS's) national cybersecurity and communications integration center (NCCIC) to assist state and local governments with cybersecurity by:

 upon request, identifying system vulnerabilities and information security protections to address unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by, or information systems used or operated by, state or local governments or other organizations or contractors on their behalf; providing via a web portal updated resources and guidelines related to information security; coordinating through national associations to implement information security tools and policies to ensure the resiliency of state and local information systems; providing training on cybersecurity, privacy, and civil liberties; providing requested technical assistance to deploy technology that continuously diagnoses and mitigates cyber threats and to conduct threat and vulnerability assessments; coordinating vulnerability disclosures under standards developed by the National Institute of Standards and Technology; and ensuring that state and local governments are aware of DHS resources and other federal tools to ensure the security and resiliency of federal civilian information systems. The NCCIC's privacy and civil liberties training must include: (1) reasonable limits on the receipt, retention, use, and disclosure of information associated with specific persons that is not necessary for cybersecurity purposes; (2) data integrity standards requiring the prompt removal and destruction of obsolete or erroneous names and personal information that is unrelated to the risk or incident information; and (3) safeguards and confidentiality protections for cyber threat indicators and defensive measures, including information that is proprietary or business-sensitive that may be used to identify specific persons from unauthorized access or acquisition.

The NCCIC must seek feedback from state and local governments on the effectiveness of such activities and provide such information to Congress.

state local cyber protection act sec bill amends homeland_security act require department_of_homeland_security dhs national cybersecurity communications integration center assist state local governments cybersecurity request identifying system vulnerabilities information security protections address unauthorized access use disclosure disruption modification destruction information collected maintained information systems operated state local governments organizations contractors behalf providing web portal updated resources guidelines related information security coordinating national associations implement information security tools policies ensure resiliency state local information systems providing training cybersecurity privacy civil liberties providing requested technical assistance deploy technology continuously diagnoses cyber threats conduct threat vulnerability assessments coordinating vulnerability disclosures standards developed national_institute_of_standards_and_technology ensuring state local governments aware dhs resources federal tools ensure security resiliency federal civilian information systems privacy civil liberties training include reasonable limits receipt retention use disclosure information associated specific persons necessary cybersecurity purposes data integrity standards requiring prompt removal destruction obsolete erroneous names personal information unrelated risk incident information safeguards confidentiality protections cyber threat indicators defensive measures including information proprietary business sensitive identify specific persons unauthorized access acquisition seek feedback state local governments effectiveness activities provide information congress


Summary:
International Cyber Policy Oversight Act of 2015

This bill directs the Department of State to: (1) produce a comprehensive strategy, with a classified annex if necessary, relating to U.S. international cyberspace policy; and (2) publicly release such strategy and brief Congress upon its release, including any accompanying classified annex.

international cyber policy oversight act bill directs department_of_state produce comprehensive strategy classified annex necessary relating international cyberspace policy publicly release strategy brief congress release including accompanying classified annex


Summary:
Security and Privacy in Your Car Study Act of 2015 or the SPY Car Study Act of 2015

This bill requires the National Highway Traffic Safety Administration to conduct a study to determine and recommend standards for the regulation of the cybersecurity of motor vehicles manufactured or imported for sale in the United States. The study shall identify:

 isolation measures that are necessary to separate critical software systems that can affect the driver's control of the movement of the vehicle from other software systems; measures that are necessary to detect and prevent or minimize anomalous codes, in vehicle software systems, associated with malicious behavior; techniques that are necessary to detect and prevent, discourage, or mitigate intrusions into vehicle software systems and other cybersecurity risks in motor vehicles; and best practices to secure driving data about a vehicle's status or about the owner, lessee, driver, or passenger of a vehicle that is collected by the electronic systems of motor vehicles.

security privacy car study act car study act bill requires national_highway_traffic_safety_administration conduct study determine recommend standards regulation cybersecurity motor vehicles manufactured imported sale united_states study shall identify isolation measures necessary separate critical software systems affect driver control movement vehicle software systems measures necessary detect prevent minimize codes vehicle software systems associated malicious behavior techniques necessary detect prevent discourage mitigate vehicle software systems cybersecurity risks motor vehicles best practices secure driving data vehicle status owner lessee driver passenger vehicle collected electronic systems motor vehicles