Sec. 304. Administrative subpoena authority
1,511 words·~7 min read·
/bill/116/hr/8309/ih/section-304·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ) is amended— in subsection (a)— by redesignating paragraph
(6)as paragraph (7); and by inserting after paragraph
(5)the following: the term security vulnerability has the meaning given that term in section 102(17) of the Cybersecurity Information Sharing Act of 2015 ( 615 U.S.C. 1501(17) ); ; in subsection (c)— in paragraph (10), by striking and at the end; in paragraph (11), by striking the period at the end and inserting ; and ; and by adding at the end the following: detecting, identifying, and receiving information about security vulnerabilities relating to critical infrastructure in the information systems and devices of Federal and non-Federal entities for a cybersecurity purpose, as defined in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ), and notifying the owners and operators of critical infrastructure with such security vulnerability. ; and by adding at the end the following: In this subsection, the term enterprise device or system — means a device or system commonly used to perform industrial, commercial, scientific, or governmental functions or processes that relate to critical infrastructure, including operational and industrial control systems, distributed control systems, and programmable logic controllers; and does not include personal devices and systems, such as consumer mobile devices, home computers, residential wireless routers, or residential internet-enabled consumer devices. If the Director identifies a system connected to the internet which he reasonably believes contains a with a specific security vulnerability and reasonably believes that the security vulnerability relates to critical infrastructure and affects an enterprise device or system owned or operated by a Federal or non-Federal entity, and the Director is unable to identify the entity at risk, the Director may issue a subpoena for the production of information necessary to identify and notify the entity at risk, in order to carry out a function authorized under subsection (c)(12). A subpoena issued under the authority under subparagraph
(A)may only seek information in the categories set forth in subparagraphs (A), (B), (D), and
(E)of section 2703(c)(2) of title 18, United States Code. The provisions of section 2703(e) of title 18, United States Code, shall apply to any subpoena issued under the authority under subparagraph (A). If the Director decides to exercise the subpoena authority under this subsection, and in the interest of avoiding interference with ongoing law enforcement investigations, the Director shall coordinate the issuance of any such subpoena with the Department of Justice, including the Federal Bureau of Investigation, pursuant to inter-agency procedures which the Director, in coordination with the Attorney General, shall develop not later than 60 days after the date of enactment of this subsection. The inter-agency procedures developed under this paragraph shall provide that a subpoena issued by the Director under this subsection shall be— issued in order to carry out a function described in subsection (c)(12); and subject to the limitations under this subsection. The regulations or guidance issued to carry out actions authorized under subsection
(n)by the Director may not be used by the Department of Justice, including the Federal Bureau of Investigation, to predicate a new investigation solely on the information contained in a subpoena issued under subsection (n). If any person, partnership, corporation, association, or entity fails to comply with any duly served subpoena issued under this subsection, the Director may request that the Attorney General seek enforcement of the subpoena in any judicial district in which such person, partnership, corporation, association, or entity resides, is found, or transacts business. Not later than 7 days after the date on which the Director receives information obtained through a subpoena issued under this subsection, the Director shall notify the entity at risk identified by information obtained under the subpoena regarding the subpoena and the identified vulnerability. Any subpoena issued by the Director under this subsection shall be authenticated by the electronic signature of an authorized representative of the Agency or other comparable symbol or process identifying the Agency as the source of the subpoena. Upon successful identification of a vulnerability on a system owned or operated by the party or entity, the Director shall, upon request— provide appropriate, detailed technical guidance to remediate, end, or mitigate the vulnerability identified by the subpoena; provide appropriate, detailed technical guidance to prevent a recurrence or the vulnerability or a similar vulnerability in the future; and provide appropriate information regarding any other exploitable vulnerabilities discovered on a system owned or operated by a party or entity during the course of investigation and remediation operations by the Agency. Not later than 90 days after the date of enactment of this subsection, the Director shall establish internal procedures and associated training, applicable to employees and operations of the Agency, regarding subpoenas issued under this subsection, which shall address— the protection of and restriction on dissemination of nonpublic information obtained through a subpoena issued under this subsection, including a requirement that the Agency shall not disseminate nonpublic information obtained through a subpoena issued under this subsection that identifies the party that is subject to the subpoena or the entity at risk identified by information obtained, unless— the party or entity consents; or the Agency identifies or is notified of a cybersecurity incident involving the party or entity, which relates to the vulnerability which led to the issuance of the subpoena; the restriction on the use of information obtained through the subpoena for a cybersecurity purpose, as defined in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ); the retention and destruction of nonpublic information obtained through a subpoena issued under this subsection, including— immediate destruction of information obtained through the subpoena that the Director determines is unrelated to critical infrastructure; and destruction of any personally identifiable information not later than 6 months after the date on which the Director receives information obtained through the subpoena, unless otherwise agreed to by the individual identified by the subpoena respondent; the processes for providing notice to each party that is subject to the subpoena and each entity at risk identified by information obtained pursuant to a subpoena issued under this subsection; the processes and criteria for conducting critical infrastructure security risk assessments to determine whether a subpoena is necessary prior to being issued under this subsection; and the processes for assisting a party or entity with removal, remediation, or other corrective measures required to address the vulnerability identified by the subpoena and, upon request, providing other resources to parties or entities to prevent a recurrence of the vulnerability or a related vulnerability in the future. Not later than 1 year after the date of enactment of this subsection, the Privacy Officer of the Agency shall— review the procedures developed by the Director under paragraph
(8)to ensure that— the procedures are consistent with fair information practices; and the operations of the Agency comply with the procedures; and notify the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives of the results of the review. Not later than 120 days after establishing the internal procedures under paragraph (8), the Director shall make publicly available information regarding the subpoena process under this subsection, including regarding— the purpose for subpoenas issued under this subsection; the subpoena process; the criteria for the critical infrastructure security risk assessment conducted prior to issuing a subpoena; policies and procedures on retention and sharing of data obtained by subpoena; guidelines on how entities contacted by the Director may respond to notice of a subpoena; and the procedures and policies of the Agency developed under paragraph (8). The Director shall annually submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report (which may include a classified annex but with the presumption of declassification) on the use of subpoenas under this subsection by the Director, which shall include— a discussion of— the effectiveness of the use of subpoenas to mitigate critical infrastructure security vulnerabilities; the critical infrastructure security risk assessment process conducted for subpoenas issued under this subsection; the number of subpoenas issued under this subsection by the Director during the preceding year; to the extent practicable, the number of vulnerable enterprise devices or systems mitigated under this subsection by the Agency during the preceding year; and the number of entities notified by the Director under this subsection, and their response, during the previous year; and for each subpoena issued under this subsection— the source of the security vulnerability detected, identified, or received by the Director; the steps taken to identify the entity at risk prior to issuing the subpoena; and a description of the outcome of the subpoena, including discussion on the resolution or mitigation of the critical infrastructure security vulnerability. The Director shall make a version of the annual report required by paragraph
(11)publicly available, which shall, at a minimum, include the findings described in clauses (iii), (iv), and
(v)of subparagraph (A). .
Connectionstraces to 2
Traces to 2 documents
1 reference not yet in our index
- 615 USC 1501(17)
Citation graph
cites case law
Cites 3Cited by 0 across 0 sources