Sec. 1637. Control and analysis of Department of Defense data stolen through cyberspace
329 words·~1 min read·
/bill/116/s/1790/es/section-1637·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
When the Secretary of Defense determines that significant Department of Defense information may have been stolen through cyberspace and evidence of theft of the data in question— is in the possession of a component of the Department, the Secretary shall— either transfer or replicate and transfer such Department data in a prompt and secure manner to a secure repository with access by Department personnel appropriately limited on a need-to-know basis; ensure the Department applies such automated analytic tools and capabilities to the repository of potentially compromised data as are necessary to rapidly understand the scope and effect of the potential compromise; for high priority Department systems, develop analytic products that characterize the scope of data compromised; ensure that all mission-affected entities in the Department are made aware of the theft or possible theft and, as damage assessment and mitigation proceeds, are kept apprised of the extent of the data stolen; and ensure that the Department counterintelligence organizations are— fully integrated with any damage assessment team assigned to the breach; fully informed of the data that have or potentially have been stolen and the effect of such theft; and provided resources and tasked, in conjunction with subject matter experts and responsible authorities, to immediately develop and execute countermeasures in response to a breach involving espionage and data theft; or is in the possession of or under controls or restrictions imposed by the Federal Bureau of Investigation, or a national counterintelligence or intelligence organization, the Secretary shall determine, jointly with the Director of the Federal Bureau of Investigation or the Director of National Intelligence, as appropriate, the most expeditious process, means, and conditions for carrying out the activities otherwise required by paragraph (1).
Not later than 90 days after the date of the enactment of this Act, the Secretary shall submit to the congressional defense committees such recommendations as the Secretary may have for legislative or administrative action to address such barriers as may be inhibiting the implementation of this section.