6 U.S.C. § 1526 — Inventory of cryptographic systems; mi-

Page 514 TITLE 6—DOMESTIC SECURITY § 1525 1 So in original. Probably should be ‘‘663(c)(2)’’. (iv) a list by agency of compliance with the requirements of section 1523(b) of this title; and (C) not later than 1 year after December 18, 2015, submit to the appropriate congres- sional committees— (i) a copy of the plan developed pursuant to section 1522(a)(2) of this title; and (ii) the improved metrics developed pur- suant to section 1522(c) of this title. (d) Form Each report required under this section shall be submitted in unclassified form, but may in- clude a classified annex. (Pub. L. 114–113, div. N, title II, § 226, Dec. 18, 2015, 129 Stat. 2969; Pub. L. 115–278, § 2(h)(1)(F), Nov. 16, 2018, 132 Stat. 4182; Pub. L. 117–263, div. G, title LXXI, § 7143(d)(1)(B), Dec. 23, 2022, 136 Stat. 3663.) Editorial Notes REFERENCES IN TEXT Subtitle D of title II of the Homeland Security Act of 2002, referred to in subsec. (c)(1)(C)(ii), is subtitle D (§§ 231–237) of title II of Pub. L. 107–296, Nov. 25, 2002, 116 Stat. 2159, which enacted part D (§ 161 et seq.) of sub- chapter II of chapter 1 of this title and amended sec- tions 10102 and 10122 of Title 34, Crime Control and Law Enforcement. Subtitle D was redesignated subtitle C of title II of the Homeland Security Act of 2002 by Pub. L. 115–278, § 2(g)(2)(K), Nov. 16, 2018, 132 Stat. 4178, and is classified principally to part C (§ 161 et seq.) of sub- chapter II of chapter 1 of this title. For complete clas- sification of subtitle C to the Code, see Tables. AMENDMENTS 2022—Subsec. (a)(2). Pub. L. 117–263 substituted ‘‘sec- tion 650 of this title’’ for ‘‘section 1501 of this title’’. 2018—Subsec. (a)(1). Pub. L. 115–278, § 2(h)(1)(F)(i)(I), substituted ‘‘section 2213’’ for ‘‘section 230’’ and struck out before period at end ‘‘, as added by section 223(a)(6) of this division’’. Subsec. (a)(4). Pub. L. 115–278, § 2(h)(1)(F)(i)(II), sub- stituted ‘‘section 2210(b)(1)’’ for ‘‘section 228(b)(1)’’ and struck out before period at end ‘‘, as added by section 223(a)(4) of this division’’. Subsec. (a)(5). Pub. L. 115–278, § 2(h)(1)(F)(i)(III), sub- stituted ‘‘section 2213(b)’’ for ‘‘section 230(b)’’ and struck out before period at end ‘‘, as added by section 223(a)(6) of this division’’. Subsec. (c)(1)(A)(vi). Pub. L. 115–278, § 2(h)(1)(F)(ii), substituted ‘‘section 2213(c)(5)’’ for ‘‘section 230(c)(5)’’ and struck out ‘‘, as added by section 223(a)(6) of this division’’ after ‘‘Homeland Security Act of 2002’’. § 1525. Termination (a) In general The authority provided under section 663 of this title, and the reporting requirements under section 1524(c) of this title shall terminate on March 14, 2025. (b) Rule of construction Nothing in subsection (a) shall be construed to affect the limitation of liability of a private en- tity for assistance provided to the Secretary under section 663(d)(2) 1 of this title, if such as- sistance was rendered before the termination date under subsection (a) or otherwise during a period in which the assistance was authorized. (Pub. L. 114–113, div. N, title II, § 227, Dec. 18, 2015, 129 Stat. 2971; Pub. L. 115–278, § 2(h)(1)(G), Nov. 16, 2018, 132 Stat. 4182; Pub. L. 117–328, div. O, title I, § 101, Dec. 29, 2022, 136 Stat. 5226; Pub. L. 118–47, div. G, title I, § 106, Mar. 23, 2024, 138 Stat. 857; Pub. L. 118–83, div. B, title I, § 103, Sept. 26, 2024, 138 Stat. 1534; Pub. L. 118–158, div. E, § 5104, Dec. 21, 2024, 138 Stat. 1771.) Editorial Notes AMENDMENTS 2024—Subsec. (a). Pub. L. 118–158 substituted ‘‘March 14, 2025’’ for ‘‘December 20, 2024’’. Pub. L. 118–83 substituted ‘‘December 20, 2024’’ for ‘‘September 30, 2024’’. Pub. L. 118–47 substituted ‘‘September 30, 2024’’ for ‘‘September 30, 2023’’. 2022—Subsec. (a). Pub. L. 117–328 substituted ‘‘Sep- tember 30, 2023’’ for ‘‘the date that is 7 years after De- cember 18, 2015’’. 2018—Subsec. (a). Pub. L. 115–278, § 2(h)(1)(G)(i), sub- stituted ‘‘section 663 of this title’’ for ‘‘section 151 of this title, as added by section 223(a)(6) of this divi- sion,’’. Subsec. (b). Pub. L. 115–278, § 2(h)(1)(G)(ii), substituted ‘‘section 663(d)(2) of this title’’ for ‘‘section 151(d)(2) of this title, as added by section 223(a)(6) of this divi- sion,’’. § 1526. Inventory of cryptographic systems; mi- gration to post-quantum cryptography (a) Inventory (1) Establishment Not later than 180 days after December 21, 2022, the Director of OMB, in coordination with the National Cyber Director and in con- sultation with the Director of CISA, shall issue guidance on the migration of informa- tion technology to post-quantum cryptog- raphy, which shall include at a minimum— (A) a requirement for each agency to es- tablish and maintain a current inventory of information technology in use by the agency that is vulnerable to decryption by quantum computers, prioritized using the criteria de- scribed in subparagraph (B); (B) criteria to allow agencies to prioritize their inventory efforts; and (C) a description of the information re- quired to be reported pursuant to subsection (b). (2) Additional content in guidance In the guidance established by paragraph (1), the Director of OMB shall include, in addition to the requirements described in that para- graph— (A) a description of information tech- nology to be prioritized for migration to post-quantum cryptography; and (B) a process for evaluating progress on migrating information technology to post- quantum cryptography, which shall be auto- mated to the greatest extent practicable. (3) Periodic updates The Director of OMB shall update the guid- ance required under paragraph (1) as the Di- rector of OMB determines necessary, in co- ordination with the National Cyber Director and in consultation with the Director of CISA. (b) Agency reports Not later than 1 year after December 21, 2022, and on an ongoing basis thereafter, the head of Page 515 TITLE 6—DOMESTIC SECURITY § 1526 each agency shall provide to the Director of OMB, the Director of CISA, and the National Cyber Director— (1) the inventory described in subsection (a)(1); and (2) any other information required to be re- ported under subsection (a)(1)(C). (c) Migration and assessment Not later than 1 year after the date on which the Director of NIST has issued post-quantum cryptography standards, the Director of OMB shall issue guidance requiring each agency to— (1) prioritize information technology de- scribed under subsection (a)(2)(A) for migra- tion to post-quantum cryptography; and (2) develop a plan to migrate information technology of the agency to post-quantum cryptography consistent with the prioritization under paragraph (1). (d) Interoperability The Director of OMB shall ensure that the prioritizations made under subsection (c)(1) are assessed and coordinated to ensure interoper- ability. (e) Office of Management and Budget reports (1) Report on post-quantum cryptography Not later than 15 months after December 21, 2022, the Director of OMB, in coordination with the National Cyber Director and in con- sultation with the Director of CISA, shall sub- mit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives a report on the following: (A) A strategy to address the risk posed by the vulnerabilities of information tech- nology of agencies to weakened encryption due to the potential and possible capability of a quantum computer to breach that encryption. (B) An estimate of the amount of funding needed by agencies to secure the informa- tion technology described in subsection (a)(1)(A) from the risk posed by an adversary of the United States using a quantum com- puter to breach the encryption of the infor- mation technology. (C) A description of Federal civilian execu- tive branch coordination efforts led by the National Institute of Standards and Tech- nology, including timelines, to develop standards for post-quantum cryptography, including any Federal Information Proc- essing Standards developed under chapter 35 of title 44, as well as standards developed through voluntary, consensus standards bod- ies such as the International Organization for Standardization. (2) Report on migration to post-quantum cryp- tography in information technology Not later than 1 year after the date on which the Director of OMB issues guidance under subsection (c)(2), and thereafter until the date that is 5 years after the date on which post- quantum cryptographic standards are issued, the Director of OMB, in coordination with the National Cyber Director and in consultation with the Director of CISA, shall submit to the Committee on Homeland Security and Govern- mental Affairs of the Senate and the Com- mittee on Oversight and Reform of the House of Representatives, with the report submitted pursuant to section 3553(c) of title 44, a report on the progress of agencies in adopting post- quantum cryptography standards. (Pub. L. 117–260, § 4, Dec. 21, 2022, 136 Stat. 2390.) Editorial Notes CODIFICATION Section was enacted as part of the Quantum Com- puting Cybersecurity Preparedness Act, and not as part of the Cybersecurity Act of 2015 which comprises this chapter. Statutory Notes and Related Subsidiaries CHANGE OF NAME Committee on Oversight and Reform of House of Rep- resentatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hundred Eighteenth Congress, Jan. 9, 2023. FINDINGS; SENSE OF CONGRESS Pub. L. 117–260, § 2, Dec. 21, 2022, 136 Stat. 2389, pro- vided that: ‘‘(a) FINDINGS.—Congress finds the following: ‘‘(1) Cryptography is essential for the national secu- rity of the United States and the functioning of the economy of the United States. ‘‘(2) The most widespread encryption protocols today rely on computational limits of classical com- puters to provide cybersecurity. ‘‘(3) Quantum computers might one day have the ability to push computational boundaries, allowing us to solve problems that have been intractable thus far, such as integer factorization, which is important for encryption. ‘‘(4) The rapid progress of quantum computing sug- gests the potential for adversaries of the United States to steal sensitive encrypted data today using classical computers, and wait until sufficiently pow- erful quantum systems are available to decrypt it. ‘‘(b) SENSE OF CONGRESS.—It is the sense of Congress that— ‘‘(1) a strategy for the migration of information technology of the Federal Government to post-quan- tum cryptography is needed; and ‘‘(2) the governmentwide and industrywide ap- proach to post-quantum cryptography should prioritize developing applications, hardware intellec- tual property, and software that can be easily up- dated to support cryptographic agility.’’ EXEMPTION OF NATIONAL SECURITY SYSTEMS Pub. L. 117–260, § 5, Dec. 21, 2022, 136 Stat. 2392, pro- vided that: ‘‘This Act [see Short Title of 2022 Amend- ment note set out under section 1500 of this title] shall not apply to any national security system.’’ DEFINITIONS Pub. L. 117–260, § 3, Dec. 21, 2022, 136 Stat. 2389, pro- vided that: ‘‘In this Act [see Short Title of 2022 Amend- ment note set out under section 1500 of this title]: ‘‘(1) AGENCY .—The term ‘agency’— ‘‘(A) means any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any inde- pendent regulatory agency; and ‘‘(B) does not include— Page 516 TITLE 6—DOMESTIC SECURITY § 1531 ‘‘(i) the Government Accountability Office; or ‘‘(ii) the governments of the District of Colum- bia and of the territories and possessions of the United States, and their various subdivisions. ‘‘(2) CLASSICAL COMPUTER.—The term ‘classical computer’ means a device that accepts digital data and manipulates the information based on a program or sequence of instructions for how data is to be proc- essed and encodes information in binary bits that can either be 0s or 1s. ‘‘(3) DIRECTOR OF CISA.—The term ‘Director of CISA’ means the Director of the Cybersecurity and Infra- structure Security Agency. ‘‘(4) DIRECTOR OF NIST.—The term ‘Director of NIST’ means the Director of the National Institute of Standards and Technology. ‘‘(5) DIRECTOR OF OMB.—The term ‘Director of OMB’ means the Director of the Office of Management and Budget. ‘‘(6) INFORMATION TECHNOLOGY.—The term ‘informa- tion technology’ has the meaning given the term in section 3502 of title 44, United States Code. ‘‘(7) NATIONAL SECURITY SYSTEM.—The term ‘na- tional security system’ has the meaning given the term in section 3552 of title 44, United States Code. ‘‘(8) POST-QUANTUM CRYPTOGRAPHY.—The term ‘post-quantum cryptography’ means those cryp- tographic algorithms or methods that are assessed not to be specifically vulnerable to attack by either a quantum computer or classical computer. ‘‘(9) QUANTUM COMPUTER.—The term ‘quantum com- puter’ means a computer that uses the collective properties of quantum states, such as superposition, interference, and entanglement, to perform calcula- tions.’’ SUBCHAPTER III—OTHER CYBER MATTERS § 1531. Apprehension and prosecution of inter- national cyber criminals (a) International cyber criminal defined In this section, the term ‘‘international cyber criminal’’ means an individual— (1) who is believed to have committed a cybercrime or intellectual property crime against the interests of the United States or the citizens of the United States; and (2) for whom— (A) an arrest warrant has been issued by a judge in the United States; or (B) an international wanted notice (com- monly referred to as a ‘‘Red Notice’’) has been circulated by Interpol. (b) Consultations for noncooperation The Secretary of State, or designee, shall con- sult with the appropriate government official of each country from which extradition is not like- ly due to the lack of an extradition treaty with the United States or other reasons, in which one or more international cyber criminals are phys- ically present, to determine what actions the government of such country has taken— (1) to apprehend and prosecute such crimi- nals; and (2) to prevent such criminals from carrying out cybercrimes or intellectual property crimes against the interests of the United States or its citizens. (c) Annual report (1) In general The Secretary of State shall submit to the appropriate congressional committees an an- nual report that includes— (A) the number of international cyber criminals located in other countries, disaggregated by country, and indicating from which countries extradition is not like- ly due to the lack of an extradition treaty with the United States or other reasons; (B) the nature and number of significant discussions by an official of the Department of State on ways to thwart or prosecute international cyber criminals with an offi- cial of another country, including the name of each such country; and (C) for each international cyber criminal who was extradited to the United States dur- ing the most recently completed calendar year— (i) his or her name; (ii) the crimes for which he or she was charged; (iii) his or her previous country of resi- dence; and (iv) the country from which he or she was extradited into the United States. (2) Form The report required by this subsection shall be in unclassified form to the maximum ex- tent possible, but may include a classified annex. (3) Appropriate congressional committees For purposes of this subsection, the term ‘‘appropriate congressional committees’’ means— (A) the Committee on Foreign Relations, the Committee on Appropriations, the Com- mittee on Homeland Security and Govern- mental Affairs, the Committee on Banking, Housing, and Urban Affairs, the Select Com- mittee on Intelligence, and the Committee on the Judiciary of the Senate; and (B) the Committee on Foreign Affairs, the Committee on Appropriations, the Com- mittee on Homeland Security, the Com- mittee on Financial Services, the Perma- nent Select Committee on Intelligence, and the Committee on the Judiciary of the House of Representatives. (Pub. L. 114–113, div. N, title IV, § 403, Dec. 18, 2015, 129 Stat. 2979.) § 1532. Enhancement of emergency services (a) Collection of data Not later than 90 days after December 18, 2015, the Secretary of Homeland Security, acting through the center established under section 659 of this title, in coordination with appropriate Federal entities and the Assistant Director for Emergency Communications, shall establish a process by which a Statewide Interoperability Coordinator may report data on any cybersecurity risk or incident involving any in- formation system or network used by emer- gency response providers (as defined in section 101 of this title) within the State. (b) Analysis of data Not later than 1 year after December 18, 2015, the Secretary of Homeland Security, acting through the Director of the National Cybersecurity and Communications Integration