Sec. 20. Protecting America from cyberattacks

753 words·~3 min read·/bill/116/hr/7007/ih/section-20

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Section 1030 of title 18, United States Code, is amended by adding at the end the following: This section shall not apply with respect to the use of attributional technology in regard to a defender who uses a program, code, or command for attributional purposes that beacons or returns locational or attributional data in response to a cyber intrusion in order to identify the source of an intrusion; if— the program, code, or command originated on the computer of the defender but is copied or removed by an unauthorized user; the program, code, or command does not result in the destruction of data or result in an impairment of the essential operating functionality of the attacker’s computer system, or intentionally create a backdoor enabling intrusive access into the attacker’s computer system; and the defender believes the attacker is an agent or an affiliate of Chinese state commercial actors in the United States, other Chinese entities or individuals financed, directed, or controlled by the Chinese State, Government of China, or the Chinese Communist Party.

The term attributional data means any digital information such as log files, text strings, time stamps, malware samples, identifiers such as user names and Internet Protocol addresses and metadata or other digital artifacts gathered through forensic analysis. . Section 1030 of title 18, United States Code, is amended by adding at the end the following: It is a defense to a criminal prosecution under this section that the conduct constituting the offense was an active cyber defense measure if the defender believes the attacker was an agent or an affiliate of Chinese state commercial actors in the United States, other Chinese entities or individuals financed, directed, or controlled by the Chinese State, the Government of China, or the Chinese Communist Party.

In this subsection— the term defender means a person or an entity that is a victim of a persistent unauthorized intrusion of the individual entity’s computer; the term active cyber defense measure — means any measure— undertaken by, or at the direction of, a defender; and consisting of accessing without authorization the computer of the attacker to the defender’s own network to gather information in order to— establish attribution of criminal activity to share with law enforcement and other United States Government agencies responsible for cybersecurity; disrupt continued unauthorized activity against the defender’s own network; or monitor the behavior of an attacker to assist in developing future intrusion prevention or cyber defense techniques; but does not include conduct that— intentionally destroys or renders inoperable information that does not belong to the victim that is stored on another person or entity’s computer; recklessly causes physical injury or financial loss as described under subsection (c)(4); creates a threat to the public health or safety; intentionally exceeds the level of activity required to perform reconnaissance on an intermediary computer to allow for attribution of the origin of the persistent cyber intrusion; intentionally results in intrusive or remote access into an intermediary’s computer; intentionally results in the persistent disruption to a person or entities internet connectivity resulting in damages defined under subsection (c)(4); or impacts any computer described under subsection (a)(1) regarding access to national security information, subsection (a)(3) regarding government computers, or to subsection (c)(4)(A)(i)(V) regarding a computer system used by or for a Government entity for the furtherance of the administration of justice, national defense, or national security; the term attacker means a person or an entity that is the source of the persistent unauthorized intrusion into the victim’s computer; and the term intermediary computer means a person or entity’s computer that is not under the ownership or primary control of the attacker but has been used to launch or obscure the origin of the persistent cyber-attack. .

Section 1030 of title 18, United States Code, is amended by adding the following: A defender who uses an active cyber defense measure under the preceding section must notify the FBI National Cyber Investigative Joint Task Force and either receive a response from the FBI acknowledging receipt of the notification or wait 48 hours prior to using the measure. Notification must include the type of cyber breach that the person or entity was a victim of, the intended target of the active cyber defense measure, the steps the defender plans to take to preserve evidence of the attacker’s criminal cyber intrusion, as well as the steps they plan to prevent damage to intermediary computers not under the ownership of the attacker and other information requested by the FBI to assist with oversight. .