Browse Arkansas Code titles and sections
6 U.S.C. § 104 — Information shared with or provided to the Federal Government
Federal law — U.S. Code and appendices · legal_authorities
**(a) Disclosure, retention, and use**
(1) **Authorized activities** — Information provided to the Agency pursuant to section 681b or 681c of this title may be disclosed to, retained by, and used by, consistent with otherwise applicable provisions of Federal law, any Federal agency or department, component, officer, employee, or agent of the Federal Government solely for—
(A) a cybersecurity purpose;
(B) the purpose of identifying—
(i) a cyber threat, including the source of the cyber threat; or
(ii) a security vulnerability;
(C) the purpose of responding to, or otherwise preventing or mitigating, a specific threat of death, a specific threat of serious bodily harm, or a specific threat of serious economic harm, including a terrorist act or use of a weapon of mass destruction;
(D) the purpose of responding to, investigating, prosecuting, or otherwise preventing or mitigating, a serious threat to a minor, including sexual exploitation and threats to physical safety; or
(E) the purpose of preventing, investigating, disrupting, or prosecuting an offense arising out of a cyber incident reported pursuant to section 681b or 681c of this title or any of the offenses listed in [section 1504(d)(5)(A)(v) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1504/d/5/A/v&num=0&edition=prelim).
(2) **Agency actions after receipt**
(A) *Rapid, confidential sharing of cyber threat indicators* — Upon receiving a covered cyber incident or ransom payment report submitted pursuant to this section, the Agency shall immediately review the report to determine whether the cyber incident that is the subject of the report is connected to an ongoing cyber threat or security vulnerability and where applicable, use such report to i
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 104
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: ce38a97defd7542661294bd493500a020b78bf223c12d4ed87624d2eb787bf12. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_a6484ee4c6a607900d6492ed
Source file: Laws/federal/codes/united-states-code/title-6/section-104-information-shared-with-or-provided-to-the-federal-government--4ccfc2ae32.md
Pages: Not recorded – Not recorded
Passage SHA-256: f4c1194651c2273e6ae40a8597332bf171b7bb922e25105da08083e4924fb854
Source location: Title 6, Chapter 1, § 104; chapter-001-homeland-security-organization.md
Stored source content
**(a) Disclosure, retention, and use**
(1) **Authorized activities** — Information provided to the Agency pursuant to section 681b or 681c of this title may be disclosed to, retained by, and used by, consistent with otherwise applicable provisions of Federal law, any Federal agency or department, component, officer, employee, or agent of the Federal Government solely for—
(A) a cybersecurity purpose;
(B) the purpose of identifying—
(i) a cyber threat, including the source of the cyber threat; or
(ii) a security vulnerability;
(C) the purpose of responding to, or otherwise preventing or mitigating, a specific threat of death, a specific threat of serious bodily harm, or a specific threat of serious economic harm, including a terrorist act or use of a weapon of mass destruction;
(D) the purpose of responding to, investigating, prosecuting, or otherwise preventing or mitigating, a serious threat to a minor, including sexual exploitation and threats to physical safety; or
(E) the purpose of preventing, investigating, disrupting, or prosecuting an offense arising out of a cyber incident reported pursuant to section 681b or 681c of this title or any of the offenses listed in [section 1504(d)(5)(A)(v) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1504/d/5/A/v&num=0&edition=prelim).
(2) **Agency actions after receipt**
(A) *Rapid, confidential sharing of cyber threat indicators* — Upon receiving a covered cyber incident or ransom payment report submitted pursuant to this section, the Agency shall immediately review the report to determine whether the cyber incident that is the subject of the report is connected to an ongoing cyber threat or security vulnerability and where applicable, use such report to identify, develop, and rapidly disseminate to appropriate stakeholders actionable, anonymized cyber threat indicators and defensive measures.
(B) *Principles for sharing security vulnerabilities* — With respect to information in a covered cyber incident or ransom payment report regarding a security vulnerability referred to in paragraph (1)(B)(ii), the Director shall develop principles that govern the timing and manner in which information relating to security vulnerabilities may be shared, consistent with common industry best practices and United States and international standards.
(3) **Privacy and civil liberties** — Information contained in covered cyber incident and ransom payment reports submitted to the Agency pursuant to [section 681b of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b&num=0&edition=prelim) shall be retained, used, and disseminated, where permissible and appropriate, by the Federal Government in accordance with processes to be developed for the protection of personal information consistent with processes adopted pursuant to [section 1504 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1504&num=0&edition=prelim) and in a manner that protects personal information from unauthorized use or unauthorized disclosure.
(4) **Digital security** — The Agency shall ensure that reports submitted to the Agency pursuant to [section 681b of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b&num=0&edition=prelim), and any information contained in those reports, are collected, stored, and protected at a minimum in accordance with the requirements for moderate impact Federal information systems, as described in Federal Information Processing Standards Publication 199, or any successor document.
(5) **Prohibition on use of information in regulatory actions**
(A) *In general* — A Federal, State, local, or Tribal government shall not use information about a covered cyber incident or ransom payment obtained solely through reporting directly to the Agency in accordance with this part to regulate, including through an enforcement action, the activities of the covered entity or entity that made a ransom payment, unless the government entity expressly allows entities to submit reports to the Agency to meet regulatory reporting obligations of the entity.
(B) *Clarification* — A report submitted to the Agency pursuant to section 681b or 681c of this title may, consistent with Federal or State regulatory authority specifically relating to the prevention and mitigation of cybersecurity threats to information systems, inform the development or implementation of regulations relating to such systems.
**(b) Protections for reporting entities and information** Reports describing covered cyber incidents or ransom payments submitted to the Agency by entities in accordance with [section 681b of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b&num=0&edition=prelim), as well as voluntarily-submitted cyber incident reports submitted to the Agency pursuant to [section 681c of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681c&num=0&edition=prelim), shall—
(1) be considered the commercial, financial, and proprietary information of the covered entity when so designated by the covered entity;
(2) be exempt from disclosure under [section 552(b)(3) of title 5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552/b/3&num=0&edition=prelim) (commonly known as the “Freedom of Information Act”), as well as any provision of State, Tribal, or local freedom of information law, open government law, open meetings law, open records law, sunshine law, or similar law requiring disclosure of information or records;
(3) be considered not to constitute a waiver of any applicable privilege or protection provided by law, including trade secret protection; and
(4) not be subject to a rule of any Federal agency or department or any judicial doctrine regarding ex parte communications with a decision-making official.
**(c) Liability protections**
(1) **In general** — No cause of action shall lie or be maintained in any court by any person or entity and any such action shall be promptly dismissed for the submission of a report pursuant to [section 681b(a) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b/a&num=0&edition=prelim) that is submitted in conformance with this part and the rule promulgated under [section 681b(b) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b/b&num=0&edition=prelim), except that this subsection shall not apply with regard to an action by the Federal Government pursuant to [section 681d(c)(2) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681d/c/2&num=0&edition=prelim).
(2) **Scope** — The liability protections provided in this subsection shall only apply to or affect litigation that is solely based on the submission of a covered cyber incident report or ransom payment report to the Agency.
(3) **Restrictions** — Notwithstanding paragraph (2), no report submitted to the Agency pursuant to this part or any communication, document, material, or other record, created for the sole purpose of preparing, drafting, or submitting such report, may be received in evidence, subject to discovery, or otherwise used in any trial, hearing, or other proceeding in or before any court, regulatory body, or other authority of the United States, a State, or a political subdivision thereof, provided that nothing in this part shall create a defense to discovery or otherwise affect the discovery of any communication, document, material, or other record not created for the sole purpose of preparing, drafting, or submitting such report.
**(d) Sharing with non-Federal entities** The Agency shall anonymize the victim who reported the information when making information provided in reports received under [section 681b of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section681b&num=0&edition=prelim) available to critical infrastructure owners and operators and the general public.
**(e) Stored Communications Act** Nothing in this part shall be construed to permit or require disclosure by a provider of a remote computing service or a provider of an electronic communication service to the public of information not otherwise permitted or required to be disclosed under chapter 121 of title 18 (commonly known as the “Stored Communications Act”).
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general**
(1) **Declaration** — The Secretary, in consultation with the National Cyber Director, may make a declaration of a significant incident in accordance with this section for the purpose of enabling the activities described in this part if the Secretary determines that—
(A) a specific significant incident—
(i) has occurred; or
(ii) is likely to occur imminently; and
(B) otherwise available resources, other than the Fund, are likely insufficient to respond effectively to, or to mitigate effectively, the specific significant incident described in subparagraph (A).
(2) **Prohibition on delegation** — The Secretary may not delegate the authority provided to the Secretary under paragraph (1).
**(b) Asset response activities** Upon a declaration, the Director shall coordinate—
(1) the asset response activities of each Federal agency in response to the specific significant incident associated with the declaration; and
(2) with appropriate entities, which may include—
(A) public and private entities and State and local governments with respect to the asset response activities of those entities and governments; and
(B) Federal, State, local, and Tribal law enforcement agencies with respect to investigations and threat response activities of those law enforcement agencies; and
(3) Federal, State, local, and Tribal emergency management and response agencies.
**(c) Duration** Subject to subsection (d), a declaration shall terminate upon the earlier of—
(1) a determination by the Secretary that the declaration is no longer necessary; or
(2) the expiration of the 120-day period beginning on the date on which the Secretary makes the declaration.
**(d) Renewal** The Secretary, without delegation, may renew a declaration as necessary.
**(
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 681b
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Requirement for policies and procedures**
(1) **Interim policies and procedures** — Not later than 60 days after December 18, 2015, the Attorney General and the Secretary of Homeland Security shall, in consultation with the heads of the appropriate Federal entities, jointly develop and submit to Congress interim policies and procedures relating to the receipt of cyber threat indicators and defensive measures by the Federal Government.
(2) **Final policies and procedures** — Not later than 180 days after December 18, 2015, the Attorney General and the Secretary of Homeland Security shall, in consultation with the heads of the appropriate Federal entities, jointly issue and make publicly available final policies and procedures relating to the receipt of cyber threat indicators and defensive measures by the Federal Government.
(3) **Requirements concerning policies and procedures** — Consistent with the guidelines required by subsection (b), the policies and procedures developed or issued under this subsection shall—
(A) ensure that cyber threat indicators shared with the Federal Government by any non-Federal entity pursuant to [section 1503(c) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1503/c&num=0&edition=prelim) through the real-time process described in subsection (c) of this section—
(i) are shared in an automated manner with all of the appropriate Federal entities;
(ii) are only subject to a delay, modification, or other action due to controls established for such real-time process that could impede real-time receipt by all of the appropriate Federal entities when the delay, modification, or other action is due to controls—
(I) agreed upon unanimously by all of the heads of the appropriate Fe
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 1504
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** There is established a Cyber Response and Recovery Fund, which shall be available for—
(1) the coordination of activities described in [section 677b(b) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section677b/b&num=0&edition=prelim);
(2) response and recovery support for the specific significant incident associated with a declaration to Federal, State, local, and Tribal, entities and public and private entities on a reimbursable or non-reimbursable basis, including through asset response activities and technical assistance, such as—
(A) vulnerability assessments and mitigation;
(B) technical incident mitigation;
(C) malware analysis;
(D) analytic support;
(E) threat detection and hunting; and
(F) network protections;
(3) as the Director determines appropriate, grants for, or cooperative agreements with, Federal, State, local, and Tribal public and private entities to respond to, and recover from, the specific significant incident associated with a declaration, such as—
(A) hardware or software to replace, update, improve, harden, or enhance the functionality of existing hardware, software, or systems; and
(B) technical contract personnel support; and
(4) advance actions taken by the Secretary under [section 677b(f)(1)(B) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section677b/f/1/B&num=0&edition=prelim).
**(b) Deposits and expenditures**
(1) **In general** — Amounts shall be deposited into the Fund from—
(A) appropriations to the Fund for activities of the Fund; and
(B) reimbursement from Federal agencies for the activities described in paragraphs (1), (2), and (4) of subsection (a), which shall only be from amounts made available in advanc
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 681c
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** The United States is authorized to participate in the Coalition for Epidemic Preparedness Innovations (referred to in this section as “CEPI”).
**(b) Investors Council and Board of Directors**
(1) **Initial designation** — The President shall designate an employee of the United States Agency for International Development to serve on the Investors Council and, if nominated, on the Board of Directors of CEPI, as a representative of the United States during the period beginning on the date of such designation and ending on September 30, 2022.
(2) **Ongoing designations** — The President may designate an employee of the relevant Federal department or agency with fiduciary responsibility for United States contributions to CEPI to serve on the Investors Council and, if nominated, on the Board of Directors of CEPI, as a representative of the United States.
(3) **Qualifications** — Any employee designated pursuant to paragraph (1) or (2) shall have demonstrated knowledge and experience in the field of development and, if designated from a Federal department or agency with primary fiduciary responsibility for United States contributions pursuant to paragraph (2), in the field of public health, epidemiology, or medicine.
(4) **Coordination** — In carrying out the responsibilities under this section, any employee designated pursuant to paragraph (1) or (2) shall coordinate with the Secretary of Health and Human Services to promote alignment, as appropriate, between CEPI and the strategic objectives and activities of the Secretary of Health and Human Services with respect to the research, development, and procurement of medical countermeasures, consistent with titles III and XXVIII of the Public Health Service Act ([42 U.S.C. 241](https://uscode.house.gov/vie
Source: Supplied U.S. Code snapshot — release unconfirmed · 22 U.S.C. § 283q
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** There is established in the Executive Office of the President an Office of Pandemic Preparedness and Response Policy (referred to in this section as the “Office”), which shall be headed by a Director (referred to in this section as the “Director”) appointed by the President and who shall be compensated at the rate provided for level II of the Executive Schedule in [section 5313 of title 5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section5313&num=0&edition=prelim). The President is authorized to appoint not more than 2 Associate Directors, who shall be compensated at a rate not to exceed that provided for level III of the Executive Schedule in section 5314 of such title. Associate Directors shall perform such functions as the Director may prescribe.
**(b) Functions of the Director** The primary function of the Director is to provide advice, within the Executive Office of the President, on policy related to preparedness for, and response to, pandemic and other biological threats that may impact national security, and support strategic coordination and communication with respect to relevant activities across the Federal Government. In addition to such other functions and activities as the President may assign, the Director, consistent with applicable laws and the National Response Framework, shall—
(1) serve as the principal advisor to the President on all matters related to pandemic preparedness and response policy and make recommendations to the President regarding pandemic and other biological threats that may impact national security;
(2) coordinate Federal activities to prepare for, and respond to, pandemic and other biological threats, by—
(A) providing strategic direction to the heads of applicable Federal departme
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 300hh–3
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Annual analysis** For each fiscal year, beginning in fiscal year 2023, the Director of the Office of Management and Budget, in consultation with the Secretary of Health and Human Services shall—
(1) conduct a detailed and comprehensive analysis of Federal biodefense programs; and
(2) develop an integrated biodefense budget submission.
**(b) Definition of biodefense** In accordance with the National Biodefense Strategy, the Director shall develop and disseminate to all Federal departments and agencies a unified definition of the term “biodefense” to identify which programs and activities are included in the annual budget submission required under subsection (a).
**(c) Requirements for analysis** The analysis required under subsection (a) shall include—
(1) the display of all funds requested for biodefense activities, both mandatory and discretionary, by agency and categorized by biodefense enterprise element, such as threat awareness, prevention, deterrence, preparedness, surveillance and detection, response, attribution (including bioforensic capabilities), recovery, and mitigation; and
(2) detailed explanations of how each program and activity included aligns with biodefense goals and objectives as part of the National Biodefense Strategy required under [section 104 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section104&num=0&edition=prelim).
**(d) Submittal to Congress** The Director, in consultation with the Secretary of Health and Human Services, shall submit to Congress the analysis required under subsection (a) for a fiscal year concurrently with the President’s annual budget request for that fiscal year.
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 121
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** The Secretaries of Health and Human Services, Defense, Agriculture, Homeland Security, and all other Departments and agencies with responsibilities for biodefense, such as the Department of State, in consultation with the Assistant to the President for National Security Affairs and the Director of the Office of Management and Budget, as appropriate, shall jointly, after reviewing the biodefense threat assessment described in subsection (d) and any relevant input from external stakeholders, as appropriate, update the National Biodefense Implementation Plan developed under [section 104 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section104&num=0&edition=prelim) to clearly document established processes, roles, and responsibilities related to the National Biodefense Strategy.
**(b) Specific updates** The updated National Biodefense Implementation Plan shall—
(1) describe the roles and responsibilities of the Federal departments and agencies, including internal and external coordination procedures, in identifying and sharing information between and among Federal departments and agencies, as described in [section 104(b)(4) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section104/b/4&num=0&edition=prelim) and consistent with the statutory roles and authorities of such departments and agencies;
(2) describe roles, responsibilities, and processes for decisionmaking, including decisions regarding use of resources for effective risk management across the enterprise;
(3) describe resource plans for each department and agency with responsibility for biodefense to support implementation of the strategy within the jurisdiction of such department or agency, including for the Biodefense C
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 121a
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 13
TITLE 6—DOMESTIC SECURITY
§ 104
available for the purposes for which appro-
priated) into the Fund.
(c) Availability of funds
Amounts deposited in the Fund shall be avail-
able until expended, and in addition to such
other funds as may be available for such pur-
poses, for information technology system mod-
ernization and facilities infrastructure improve-
ments necessary for the operation of the Depart-
ment, subject to approval by the Office of Man-
agement and Budget.
(d) Limitation on apportionment or allotment of
funds
Amounts in the Fund may not be apportioned
or allotted for any fiscal year until after the
date on which the Act making full-year appro-
priations for the Department of Homeland Secu-
rity for the applicable fiscal year is enacted into
law, subject to subsection (e).
(e) Notification of planned use of funds
The Committees on Appropriations of the
House of Representatives and the Senate shall
be notified at least 15 days in advance of the
planned use of funds.
(Pub. L. 117–103, div. F, title V, § 538, Mar. 15,
2022, 136 Stat. 343; Pub. L. 118–47, div. C, title V,
§ 539(a), Mar. 23, 2024, 138 Stat. 623.)
Editorial Notes
CODIFICATION
Section was enacted as part of the Department of
Homeland Security Appropriations Act, 2022, and also
as part of the Consolidated Appropriations Act, 2022,
and not as part of the Homeland Security Act of 2002
which comprises this chapter.
AMENDMENTS
2024—Subsecs. (d), (e). Pub. L. 118–47 added subsecs.
(d) and (e) and struck out former subsec. (d). Prior to
amendment, text of subsec. (d) read as follows:
‘‘Amounts in the Fund may be obligated only after the
Committees on Appropriations of the House of Rep-
resentatives and the Senate are notified at least 15
days in advance of the plann
Source: Supplied 2024 U.S. Code historical extraction · 6 U.S.C. § 104
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.