15 U.S.C. § 7421 — Definitions

Page 2355 TITLE 15—COMMERCE AND TRADE § 7421 the President for National Security Affairs, shall submit to Congress a report reviewing this chapter to ensure that the programs and fellow- ships are being awarded under this chapter to in- dividuals and institutions of higher education who are in compliance with the Immigration and Nationality Act (8 U.S.C. 1101 et seq.) in order to protect our national security. (Pub. L. 107–305, § 17, Nov. 27, 2002, 116 Stat. 2381.) Editorial Notes REFERENCES IN TEXT This chapter, referred to in text, was in the original ‘‘this Act’’, meaning Pub. L. 107–305, Nov. 27, 2002, 116 Stat. 2367, known as the Cyber Security Research and Development Act, which is classified principally to this chapter. For complete classification of this Act to the Code, see Short Title note set out under section 7401 of this title and Tables. The Immigration and Nationality Act, referred to in text, is act June 27, 1952, ch. 477, 66 Stat. 163, which is classified principally to chapter 12 (§ 1101 et seq.) of Title 8, Aliens and Nationality. For complete classi- fication of this Act to the Code, see Short Title note set out under section 1101 of Title 8 and Tables. CHAPTER 100A—CYBERSECURITY ENHANCEMENT Sec. 7421. Definitions. 7422. No regulatory authority. 7423. No additional funds authorized. SUBCHAPTER I—CYBERSECURITY RESEARCH AND DEVELOPMENT 7431. Federal cybersecurity research and develop- ment. 7432. National cybersecurity challenges. SUBCHAPTER II—EDUCATION AND WORKFORCE DEVELOPMENT 7441. Cybersecurity competitions and challenges. 7442. Federal Cyber Scholarship-for-Service Pro- gram. 7443. National cybersecurity awareness and edu- cation program. SUBCHAPTER III—CYBERSECURITY AWARENESS AND PREPAREDNESS 7451. Transferred. SUBCHAPTER IV—ADVANCEMENT OF CYBERSECURITY TECHNICAL STANDARDS 7461. Definitions. 7462. International cybersecurity technical stand- ards. 7463. Cloud computing strategy. 7464. Identity management research and develop- ment. § 7421. Definitions In this chapter: (1) Cybersecurity mission The term ‘‘cybersecurity mission’’ means ac- tivities that encompass the full range of threat reduction, vulnerability reduction, de- terrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network oper- ations, information assurance, law enforce- ment, diplomacy, military, and intelligence missions as such activities relate to the secu- rity and stability of cyberspace. (2) Information system The term ‘‘information system’’ has the meaning given that term in section 3502 of title 44. (Pub. L. 113–274, § 2, Dec. 18, 2014, 128 Stat. 2971.) Editorial Notes REFERENCES IN TEXT This chapter, referred to in text, was in the original ‘‘this Act’’, meaning Pub. L. 113–274, Dec. 18, 2014, 128 Stat. 2971, which is classified principally to this chap- ter. For complete classification of this Act to the Code, see Short Title note set out below and Tables. Statutory Notes and Related Subsidiaries SHORT TITLE Pub. L. 113–274, § 1(a), Dec. 18, 2014, 128 Stat. 2971, pro- vided that: ‘‘This Act [enacting this chapter and amending sections 272, 278g–3, 7403, and 7406 of this title] may be cited as the ‘Cybersecurity Enhancement Act of 2014’.’’ Executive Documents EX. ORD. NO. 13984. TAKING ADDITIONAL STEPS TO AD- DRESS THE NATIONAL EMERGENCY WITH RESPECT TO SIGNIFICANT MALICIOUS CYBER-ENABLED ACTIVITIES Ex. Ord. No. 13984, Jan. 19, 2021, 86 F.R. 6837, provided: By the authority vested in me as President by the Constitution and the laws of the United States of America, including the International Emergency Eco- nomic Powers Act (50 U.S.C. 1701 et seq.) (IEEPA), the National Emergencies Act (50 U.S.C. 1601 et seq.) (NEA), and section 301 of title 3, United States Code: I, DONALD J. TRUMP, President of the United States of America, find that additional steps must be taken to deal with the national emergency related to significant malicious cyber-enabled activities declared in Executive Order 13694 of April 1, 2015 (Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities), as amended [50 U.S.C. 1701 note], to address the use of United States Infrastructure as a Service (IaaS) products by foreign malicious cyber actors. IaaS products provide persons the ability to run software and store data on servers of- fered for rent or lease without responsibility for the maintenance and operating costs of those servers. For- eign malicious cyber actors aim to harm the United States economy through the theft of intellectual prop- erty and sensitive data and to threaten national secu- rity by targeting United States critical infrastructure for malicious cyber-enabled activities. Foreign actors use United States IaaS products for a variety of tasks in carrying out malicious cyber-enabled activities, which makes it extremely difficult for United States officials to track and obtain information through legal process before these foreign actors transition to re- placement infrastructure and destroy evidence of their prior activities; foreign resellers of United States IaaS products make it easier for foreign actors to access these products and evade detection. This order provides authority to impose record-keeping obligations with respect to foreign transactions. To address these threats, to deter foreign malicious cyber actors’ use of United States IaaS products, and to assist in the inves- tigation of transactions involving foreign malicious cyber actors, the United States must ensure that pro- viders offering United States IaaS products verify the identity of persons obtaining an IaaS account (‘‘Ac- count’’) for the provision of these products and main- tain records of those transactions. In appropriate cir- cumstances, to further protect against malicious cyber-enabled activities, the United States must also limit certain foreign actors’ access to United States IaaS products. Further, the United States must encour- Page 2356 TITLE 15—COMMERCE AND TRADE § 7421 age more robust cooperation among United States IaaS providers, including by increasing voluntary informa- tion sharing, to bolster efforts to thwart the actions of foreign malicious cyber actors. Accordingly, I hereby order: SECTION 1. Verification of Identity. Within 180 days of the date of this order [Jan. 19, 2021], the Secretary of Commerce (Secretary) shall propose for notice and comment regulations that require United States IaaS providers to verify the identity of a foreign person that obtains an Account. These regulations shall, at a min- imum: (a) set forth the minimum standards that United States IaaS providers must adopt to verify the identity of a foreign person in connection with the opening of an Account or the maintenance of an existing Account, in- cluding: (i) the types of documentation and procedures re- quired to verify the identity of any foreign person act- ing as a lessee or sub-lessee of these products or serv- ices; (ii) records that United States IaaS providers must securely maintain regarding a foreign person that ob- tains an Account, including information establishing: (A) the identity of such foreign person and the per- son’s information, including name, national identi- fication number, and address; (B) means and source of payment (including any as- sociated financial institution and other identifiers such as credit card number, account number, cus- tomer identifier, transaction identifiers, or virtual currency wallet or wallet address identifier); (C) electronic mail address and telephonic contact information, used to verify a foreign person’s iden- tity; and (D) internet Protocol addresses used for access or administration and the date and time of each such access or administrative action, related to ongoing verification of such foreign person’s ownership of such an Account; and (iii) methods for limiting all third-party access to the information described in this subsection, except insofar as such access is otherwise consistent with this order and allowed under applicable law; (b) take into consideration the type of Account main- tained by United States IaaS providers, methods of opening an Account, and types of identifying informa- tion available to accomplish the objectives of identi- fying foreign malicious cyber actors using any such products and avoiding the imposition of an undue bur- den on such providers; and (c) permit the Secretary, in accordance with such standards and procedures as the Secretary may delin- eate and in consultation with the Secretary of Defense, the Attorney General, the Secretary of Homeland Secu- rity, and the Director of National Intelligence, to ex- empt any United States IaaS provider, or any specific type of Account or lessee, from the requirements of any regulation issued pursuant to this section. Such stand- ards and procedures may include a finding by the Sec- retary that a provider, Account, or lessee complies with security best practices to otherwise deter abuse of IaaS products. SEC. 2. Special Measures for Certain Foreign Jurisdic- tions or Foreign Persons. (a) Within 180 days of the date of this order, the Secretary shall propose for notice and comment regulations that require United States IaaS providers to take any of the special measures described in subsection (d) of this section if the Secretary, in con- sultation with the Secretary of State, the Secretary of the Treasury, the Secretary of Defense, the Attorney General, the Secretary of Homeland Security, the Di- rector of National Intelligence and, as the Secretary deems appropriate, the heads of other executive depart- ments and agencies (agencies), finds: (i) that reasonable grounds exist for concluding that a foreign jurisdiction has any significant number of foreign persons offering United States IaaS products that are used for malicious cyber-enabled activities or any significant number of foreign persons directly ob- taining United States IaaS products for use in mali- cious cyber-enabled activities, in accordance with sub- section (b) of this section; or (ii) that reasonable grounds exist for concluding that a foreign person has established a pattern of conduct of offering United States IaaS products that are used for malicious cyber-enabled activities or directly obtain- ing United States IaaS products for use in malicious cyber-enabled activities. (b) In making findings under subsection (a) of this section on the use of United States IaaS products in malicious cyber-enabled activities, the Secretary shall consider any information the Secretary determines to be relevant, as well as information pertaining to the following factors: (i) Factors related to a particular foreign jurisdic- tion, including: (A) evidence that foreign malicious cyber actors have obtained United States IaaS products from per- sons offering United States IaaS products in that for- eign jurisdiction, including whether such actors ob- tained such IaaS products through Reseller Accounts; (B) the extent to which that foreign jurisdiction is a source of malicious cyber-enabled activities; and (C) Whether [sic] the United States has a mutual legal assistance treaty with that foreign jurisdiction, and the experience of United States law enforcement officials and regulatory officials in obtaining infor- mation about activities involving United States IaaS products originating in or routed through such for- eign jurisdiction; and (ii) Factors related to a particular foreign person, in- cluding: (A) the extent to which a foreign person uses United States IaaS products to conduct, facilitate, or promote malicious cyber-enabled activities; (B) the extent to which United States IaaS products offered by a foreign person are used to facilitate or promote malicious cyber-enabled activities; (C) the extent to which United States IaaS products offered by a foreign person are used for legitimate business purposes in the jurisdiction; and (D) the extent to which actions short of the imposi- tion of special measures pursuant to subsection (d) of this section are sufficient, with respect to trans- actions involving the foreign person offering United States IaaS products, to guard against malicious cyber-enabled activities. (c) In selecting which special measure or measures to take under this section, the Secretary shall consider: (i) whether the imposition of any special measure would create a significant competitive disadvantage, including any undue cost or burden associated with compliance, for United States IaaS providers; (ii) the extent to which the imposition of any special measure or the timing of the special measure would have a significant adverse effect on legitimate business activities involving the particular foreign jurisdiction or foreign person; and (iii) the effect of any special measure on United States national security, law enforcement investiga- tions, or foreign policy. (d) The special measures referred to in subsections (a), (b), and (c) of this section are as follows: (i) Prohibitions or Conditions on Accounts within Certain Foreign Jurisdictions: The Secretary may pro- hibit or impose conditions on the opening or maintain- ing with any United States IaaS provider of an Ac- count, including a Reseller Account, by any foreign person located in a foreign jurisdiction found to have any significant number of foreign persons offering United States IaaS products used for malicious cyber- enabled activities, or by any United States IaaS pro- vider for or on behalf of a foreign person; and (ii) Prohibitions or Conditions on Certain Foreign Persons: The Secretary may prohibit or impose condi- tions on the opening or maintaining in the United States of an Account, including a Reseller Account, by any United States IaaS provider for or on behalf of a foreign person, if such an Account involves any such Page 2357 TITLE 15—COMMERCE AND TRADE § 7421 foreign person found to be offering United States IaaS products used in malicious cyber-enabled activities or directly obtaining United States IaaS products for use in malicious cyber-enabled activities. (e) The Secretary shall not impose requirements for United States IaaS providers to take any of the special measures described in subsection (d) of this section ear- lier than 180 days following the issuance of final regula- tions described in section 1 of this order. SEC. 3. Recommendations for Cooperative Efforts to Deter the Abuse of United States IaaS Products. (a) Within 120 days of the date of this order, the Attorney General and the Secretary of Homeland Security, in coordination with the Secretary and, as the Attorney General and the Secretary of Homeland Security deem appropriate, the heads of other agencies, shall engage and solicit feedback from industry on how to increase information sharing and collaboration among IaaS providers and be- tween IaaS providers and the agencies to inform rec- ommendations under subsection (b) of this section. (b) Within 240 days of the date of this order, the At- torney General and the Secretary of Homeland Secu- rity, in coordination with the Secretary, and, as the Attorney General and Secretary of Homeland Security deem appropriate, the heads of other agencies, shall de- velop and submit to the President a report containing recommendations to encourage: (i) voluntary information sharing and collaboration, among United States IaaS providers; and (ii) information sharing between United States IaaS providers and appropriate agencies, including the re- porting of incidents, crimes, and other threats to na- tional security, for the purpose of preventing further harm to the United States. (c) The report and recommendations provided under subsection (b) of this section shall consider existing mechanisms for such sharing and collaboration, includ- ing the Cybersecurity Information Sharing Act [of 2015] (6 U.S.C. 1503 [probably should be ‘‘1501’’] et seq.), and shall identify any gaps in current law, policy, or proce- dures. The report shall also include: (i) information related to the operations of foreign malicious cyber actors, the means by which such actors use IaaS products within the United States, malicious capabilities and tradecraft, and the extent to which persons in the United States are compromised or un- wittingly involved in such activity; (ii) recommendations for liability protections beyond those in existing law that may be needed to encourage United States IaaS providers to share information among each other and with the United States Govern- ment; and (iii) recommendations for facilitating the detection and identification of Accounts and activities that in- volve foreign malicious cyber actors. SEC. 4. Ensuring Sufficient Resources for Implementa- tion. The Secretary, in consultation with the heads of such agencies as the Secretary deems appropriate, shall identify funding requirements to support the efforts de- scribed in this order and incorporate such requirements into its annual budget submissions to the Office of Management and Budget. SEC. 5. Definitions. For the purposes of this order, the following definitions apply: (a) The term ‘‘entity’’ means a partnership, associa- tion, trust, joint venture, corporation, group, subgroup, or other organization; (b) The term ‘‘foreign jurisdiction’’ means any coun- try, subnational territory, or region, other than those subject to the civil or military jurisdiction of the United States, in which any person or group of persons exercises sovereign de facto or de jure authority, in- cluding any such country, subnational territory, or re- gion in which a person or group of persons is assuming to exercise governmental authority whether such a per- son or group of persons has or has not been recognized by the United States; (c) The term ‘‘foreign person’’ means a person that is not a United States person; (d) The term ‘‘Infrastructure as a Service Account’’ or ‘‘Account’’ means a formal business relationship es- tablished to provide IaaS products to a person in which details of such transactions are recorded. (e) The term ‘‘Infrastructure as a Service Product’’ means any product or service offered to a consumer, in- cluding complimentary or ‘‘trial’’ offerings, that pro- vides processing, storage, networks, or other funda- mental computing resources, and with which the con- sumer is able to deploy and run software that is not predefined, including operating systems and applica- tions. The consumer typically does not manage or con- trol most of the underlying hardware but has control over the operating systems, storage, and any deployed applications. The term is inclusive of ‘‘managed’’ prod- ucts or services, in which the provider is responsible for some aspects of system configuration or maintenance, and ‘‘unmanaged’’ products or services, in which the provider is only responsible for ensuring that the prod- uct is available to the consumer. The term is also in- clusive of ‘‘virtualized’’ products and services, in which the computing resources of a physical machine are split between virtualized computers accessible over the internet (e.g., ‘‘virtual private servers’’), and ‘‘dedi- cated’’ products or services in which the total com- puting resources of a physical machine are provided to a single person (e.g., ‘‘bare-metal’’ servers); (f) The term ‘‘malicious cyber-enabled activities’’ re- fers to activities, other than those authorized by or in accordance with United States law that seek to com- promise or impair the confidentiality, integrity, or availability of computer, information, or communica- tions systems, networks, physical or virtual infrastruc- ture controlled by computers or information systems, or information resident thereon; (g) The term ‘‘person’’ means an individual or entity; (h) The term ‘‘Reseller Account’’ means an Infra- structure as a Service Account established to provide IaaS products to a person who will then offer those products subsequently, in whole or in part, to a third party. (i) The term ‘‘United States Infrastructure as a Serv- ice Product’’ means any Infrastructure as a Service Product owned by any United States person or operated within the territory of the United States of America; (j) The term ‘‘United States Infrastructure as a Serv- ice Provider’’ means any United States Person that of- fers any Infrastructure as a Service Product; (k) The term ‘‘United States person’’ means any United States citizen, lawful permanent resident of the United States as defined by the Immigration and Na- tionality Act, entity organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person lo- cated in the United States; SEC. 6. Amendment to Reporting Authorizations. [Amended Ex. Ord. No. 13694, listed in a table under sec- tion 1701 of Title 50, War and National Defense.] SEC. 7. General Provisions. (a) The Secretary, in con- sultation with the heads of such other agencies as the Secretary deems appropriate, is hereby authorized to take such actions, including the promulgation of rules and regulations, and employ all powers granted to the President by IEEPA as may be necessary to carry out the purposes of this order. The Secretary may redele- gate any of these functions to other officers within the Department of Commerce, consistent with applicable law. All departments and agencies of the United States Government are hereby directed to take all appropriate measures within their authority to carry out the provi- sions of this order. (b) Nothing in this order shall be construed to impair or otherwise affect: (i) the authority granted by law to an executive de- partment or agency, or the head thereof; or (ii) the functions of the Director of the Office of Man- agement and Budget relating to budgetary, administra- tive, or legislative proposals. (c) This order shall be implemented consistent with applicable law and subject to the availability of appro- priations. (d) Nothing in this order prohibits or otherwise re- stricts authorized intelligence, military, law enforce- Page 2358 TITLE 15—COMMERCE AND TRADE § 7422 ment, or other activities in furtherance of national se- curity or public safety activities. (e) This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforce- able at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person. DONALD J. TRUMP. § 7422. No regulatory authority Nothing in this chapter shall be construed to confer any regulatory authority on any Federal, State, tribal, or local department or agency. (Pub. L. 113–274, § 3, Dec. 18, 2014, 128 Stat. 2972.) Editorial Notes REFERENCES IN TEXT This chapter, referred to in text, was in the original ‘‘this Act’’, meaning Pub. L. 113–274, Dec. 18, 2014, 128 Stat. 2971, which is classified principally to this chap- ter. For complete classification of this Act to the Code, see Short Title note set out under section 7421 of this title and Tables. § 7423. No additional funds authorized No additional funds are authorized to carry out this Act, and the amendments made by this Act. This Act, and the amendments made by this Act, shall be carried out using amounts oth- erwise authorized or appropriated. (Pub. L. 113–274, § 4, Dec. 18, 2014, 128 Stat. 2972.) Editorial Notes REFERENCES IN TEXT This Act, and the amendments made by this Act, re- ferred to in text, is Pub. L. 113–274, Dec. 18, 2014, 128 Stat. 2971, which enacted this chapter and amended sec- tions 272, 278g–3, 7403, and 7406 of this title. For com- plete classification of this Act to the Code, see Short Title note set out under section 7421 of this title and Tables. SUBCHAPTER I—CYBERSECURITY RESEARCH AND DEVELOPMENT § 7431. Federal cybersecurity research and devel- opment (a) Fundamental cybersecurity research (1) Federal cybersecurity research and devel- opment strategic plan The heads of the applicable agencies and de- partments, working through the National Science and Technology Council and the Net- working and Information Technology Re- search and Development Program, shall de- velop and update every 4 years a Federal cybersecurity research and development stra- tegic plan (referred to in this subsection as the ‘‘strategic plan’’) based on an assessment of cybersecurity risk to guide the overall direc- tion of Federal cybersecurity and information assurance research and development for infor- mation technology and networking systems. The heads of the applicable agencies and de- partments shall build upon existing programs and plans to develop the strategic plan to meet objectives in cybersecurity, such as— (A) how to design and build complex soft- ware-intensive systems that are secure and reliable when first deployed; (B) how to test and verify that software and hardware, whether developed locally or obtained from a third party, is free of sig- nificant known security flaws; (C) how to test and verify that software and hardware obtained from a third party correctly implements stated functionality, and only that functionality; (D) how to guarantee the privacy of an in- dividual, including that individual’s iden- tity, information, and lawful transactions when stored in distributed systems or trans- mitted over networks; (E) how to build new protocols to enable the Internet to have robust security as one of the key capabilities of the Internet; (F) how to determine the origin of a mes- sage transmitted over the Internet; (G) how to support privacy in conjunction with improved security; (H) how to address the problem of insider threats; (I) how improved consumer education and digital literacy initiatives can address human factors that contribute to cybersecurity; (J) how to protect information processed, transmitted, or stored using cloud com- puting or transmitted through wireless serv- ices; (K) implementation of section 7432 of this title through research and development on the topics identified under subsection (a) of such section; and (L) any additional objectives the heads of the applicable agencies and departments, in coordination with the head of any relevant Federal agency and with input from stake- holders, including appropriate national lab- oratories, industry, and academia, deter- mine appropriate. (2) Requirements (A) Contents of plan The strategic plan shall— (i) specify and prioritize near-term, mid- term, and long-term research objectives, including objectives associated with the research identified in section 7403(a)(1) of this title; (ii) specify how the near-term objectives described in clause (i) complement re- search and development areas in which the private sector is actively engaged; (iii) describe how the heads of the appli- cable agencies and departments will focus on innovative, transformational tech- nologies with the potential to enhance the security, reliability, resilience, and trust- worthiness of the digital infrastructure, and to protect consumer privacy; (iv) describe how the heads of the appli- cable agencies and departments will foster the rapid transfer of research and develop- ment results into new cybersecurity tech- nologies and applications for the timely benefit of society and the national inter- est, including through the dissemination of best practices and other outreach ac- tivities; (v) describe how the heads of the applica- ble agencies and departments will estab-